MS-102 Practice Question: With Microsoft Entra ID P2 licenses needs to…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create a Conditional Access policy that requires MFA and select FIDO2 as the authentication strength in the grant controls

  Why it's wrong here

  In Conditional Access, you cannot select an individual authentication method like FIDO2 directly in the grant controls. The Grant control only offers the option to require an 'authentication strength,' which must be a policy you define first in Microsoft Entra ID. Creating a policy that simply says 'Require MFA' and trying to pick FIDO2 as a specific strength is impossible because no built-in strength is named 'FIDO2'; you must build a custom authentication strength that includes FIDO2 and then reference it in the grant control.

• ✗

  Create a Conditional Access policy that requires MFA and set the grant control to require a specific device platform

  Why it's wrong here

  Setting a grant control to require a specific device platform (e.g., Windows or macOS) only controls which device operating systems are allowed to access the resource. It does not enforce any particular authentication method; a user could still satisfy an MFA prompt using an authenticator app, SMS, or a different method as long as they are on the allowed platform. To require FIDO2 specifically, you need to use an authentication strength policy that defines FIDO2 as acceptable and assign that strength to a Conditional Access grant control.

• ✓

  Configure an authentication strength policy that requires FIDO2 and assign it to a Conditional Access policy

  Why this is correct

  This is correct because Microsoft Entra ID authentication strengths let you define exactly which authentication methods are acceptable for a sign-in. To require FIDO2 security keys, you create a custom authentication strength that includes only the FIDO2 security key method, then assign that strength to a Conditional Access policy's 'Require authentication strength' grant control. This enforces the method at sign-in time, ensuring that users must authenticate with a FIDO2 security key to access the protected resource.

• ✗

  Configure an authentication methods policy that allows only FIDO2 security keys

  Why it's wrong here

  The authentication methods policy determines which methods users can register and use in the organization, but it does not enforce any specific authentication method for a given application or sign-in. Even if you allow only FIDO2 security keys in the authentication methods policy, users might still be able to complete MFA using other methods such as password plus Microsoft Authenticator if a Conditional Access policy requires MFA. To enforce FIDO2 for a specific access scenario, you must combine the methods policy with a Conditional Access policy that uses an authentication strength specifying FIDO2.

Go deeper

Related to this question