hardMultiple ChoiceObjective-mapped
MD-102 Practice Question: You manage a Microsoft 365 tenant with 10,000…
You manage a Microsoft 365 tenant with 10,000 users. You are planning a Conditional Access policy to require MFA for all users. However, you need to ensure that users who have not yet registered for MFA are not blocked. What should you do to handle unregistered users?
⚠ Common exam trap
Many candidates confuse 'Report-only mode' (which only logs, not registers) with a solution for handling unregistered users, or they incorrectly assume that excluding unregistered users or creating a separate policy for them would solve the problem without causing lockout.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable the Azure AD Identity Protection MFA registration policy to require users to register for MFA within 14 days.
The Azure AD Identity Protection MFA registration policy automatically enforces MFA registration for all users within a specified grace period (default 14 days), ensuring that users who have not yet registered are prompted to register before being blocked by a Conditional Access policy. This policy works in conjunction with Conditional Access by pre-registering users, so when the CA policy requiring MFA is enabled, all users already have MFA credentials available, preventing lockout.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure the Conditional Access policy in 'Report-only' mode to identify unregistered users.
Why it's wrong here
Report-only mode doesn't block, but it also doesn't force registration; unregistered users would still be able to access resources without MFA.
- ✓
Enable the Azure AD Identity Protection MFA registration policy to require users to register for MFA within 14 days.
Why this is correct
This policy ensures users register before they are required to use MFA, preventing lockout.
- ✗
Exclude all users who have not registered for MFA from the Conditional Access policy.
Why it's wrong here
This would leave those users unprotected, which is not secure.
- ✗
Create a separate Conditional Access policy that requires MFA only for users who have not registered for MFA.
Why it's wrong here
Unregistered users cannot satisfy the MFA requirement, so they would be blocked.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
Key term
Conditional Access policy
A Conditional Access policy is a set of rules in Microsoft Entra ID that automatically grants or blocks access to cloud apps based on signals like user identity, location, device health, and risk level.
About these practice questions
One of 942 original MD-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.