AZ-500 Secure identity and access Practice Question
Your organization uses Microsoft Entra ID for identity management. You need to ensure that users can sign in using a one-time passcode sent to their mobile device, without requiring any additional app or software installation. Which authentication method should you enable?
⚠ Common exam trap
Many candidates confuse the 'one-time passcode' option with the Microsoft Authenticator app's push notification or time-based code feature, but the question explicitly requires no additional app installation, making the SMS-based OTP the only correct choice.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
One-time passcode (OTP)
The one-time passcode (OTP) authentication method in Microsoft Entra ID allows users to sign in with a temporary code sent via SMS to their mobile device, requiring no additional app or software installation. This method is specifically designed for scenarios where users cannot or should not install the Microsoft Authenticator app, such as for guest users or in bring-your-own-device (BYOD) environments. The OTP is generated by Entra ID and delivered over the mobile network, satisfying the requirement of no extra software.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
One-time passcode (OTP)
Why this is correct
One-time passcode (OTP) is a built-in Microsoft Entra ID authentication method that sends a verification code to a user's verified email or phone number via SMS or email. It requires no additional app installation, hardware token, or certificate infrastructure, making it the simplest way to authenticate a user without a password. The code is time-limited and used once, providing a low-friction option for temporary or initial sign-in scenarios.
- ✗
Microsoft Authenticator app
Why it's wrong here
The Microsoft Authenticator app provides strong authentication by generating a time-based code or supporting push notifications and passwordless phone sign-in. However, it is not a built-in, zero-footprint solution: the user must install the app on a mobile device, register it with their Entra ID account, and maintain an internet connection. Therefore it fails when the requirement is to avoid deploying additional software or hardware.
- ✗
FIDO2 security keys
Why it's wrong here
FIDO2 security keys are a phishing-resistant passwordless method that uses a physical key (USB, NFC, or Bluetooth) to sign in. This approach requires purchasing and distributing hardware keys to each user, configuring dynamic lockouts, and ensuring device compatibility, which is significantly more complex than a built-in software option. It is wrong when the objective is to avoid hardware deployment and minimize extra prerequisites.
- ✗
Certificate-based authentication
Why it's wrong here
Certificate-based authentication (CBA) requires an enterprise public key infrastructure to issue, enroll, renew, and revoke client certificates on managed devices. The authentication relies on the certificate being provisioned to the user's device, which demands MDM or GPO deployment and ongoing certificate lifecycle management. This makes it unsuitable if you want to avoid certificate infrastructure and device management overhead.
Go deeper
Related to this question
About these practice questions
One of 617 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.