AZ-500 Secure identity and access Practice Question
You are the identity security engineer for a company that uses Microsoft Entra ID. A new security policy requires that any user who is assigned the Global Administrator role must use a phishing-resistant authentication method when signing in. You need to enforce this requirement with the least administrative effort. What should you do?
⚠ Common exam trap
The trap here is assuming that enabling security defaults or per-user MFA can enforce phishing-resistant authentication for a specific privileged role.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Conditional Access policy that targets the Global Administrator directory role and requires an authentication strength of Phishing-resistant MFA.
A Conditional Access policy scoped to directory roles and combined with an authentication strength requirement is the supported way to mandate phishing-resistant MFA for privileged users. Authentication strengths map to method combinations such as FIDO2 security keys and certificate-based authentication, giving you granular, role-based enforcement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a per-user MFA setting for each Global Administrator and disable SMS and voice call methods.
Why it's wrong here
Per-user MFA is a legacy setting that cannot require phishing-resistant methods or target a role. Disabling SMS and voice for a user still leaves weaker methods such as push notifications available, so it does not guarantee phishing-resistant authentication for privileged accounts.
- ✗
Enable security defaults for the tenant and require all users to register for Microsoft Authenticator.
Why it's wrong here
Security defaults enforce a baseline of MFA for all users but do not let you require phishing-resistant methods specifically for Global Administrators. They also cannot target a directory role, so this does not meet the stated requirement and would affect all users rather than only privileged role holders.
- ✗
Assign a Microsoft Entra ID P1 license to each Global Administrator and enable self-service password reset with number matching.
Why it's wrong here
Number matching improves push notification security but is not a phishing-resistant method and does not enforce authentication strength. Licensing and SSPR configuration do not create a policy that requires Global Administrators to use certificate-based or FIDO2 authentication.
- ✓
Create a Conditional Access policy that targets the Global Administrator directory role and requires an authentication strength of Phishing-resistant MFA.
Why this is correct
Conditional Access can target directory roles, and authentication strengths let you require specific method combinations such as phishing-resistant MFA. This directly enforces the policy for Global Administrators without changing per-user settings or relying on legacy per-user MFA, which cannot distinguish phishing-resistant methods.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 617 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.