Enforce MFA for All Users Without Requiring Registration
You need to enforce multifactor authentication (MFA) for all users in a Microsoft Entra ID tenant. The solution must not require users to register security info if they already have it. Which approach should you use?
Quick Answer
The answer is to create a Conditional Access policy that requires MFA for all users. This approach is correct because Conditional Access policies evaluate sign-in risks and enforce MFA at the point of authentication, but they do not force users to re-register security information if it already exists in their account. The policy simply triggers the MFA challenge during login, respecting any previously saved registration methods like the Microsoft Authenticator app or phone number. On the MS-102 exam, this question tests your understanding of how Conditional Access differs from legacy per-user MFA enforcement, which would force registration even for users who already have security info. A common trap is choosing a security default or per-user MFA setting, both of which require all users to register from scratch. Remember the key distinction: Conditional Access enforces the *action* of MFA, not the *setup* of it. Memory tip: "Conditional Access checks the lock, it doesn’t hand out new keys."
⚠ Common exam trap
It's easy for candidates to confuse security defaults (which enforce MFA but force registration) with Conditional Access (which can enforce MFA without forcing re-registration), leading them to choose D instead of C.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Conditional Access policy that requires MFA for all users
A Conditional Access policy can require MFA for all users while respecting existing security info registration. The policy triggers MFA during sign-in but does not force re-registration if the user has already registered. This meets the requirement of not requiring users to register security info if they already have it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use identity protection to enforce MFA for risky sign-ins
Why it's wrong here
This only applies to risky sign-ins, not all users.
- ✗
Assign MFA per user in the Microsoft Entra admin center
Why it's wrong here
Per-user MFA requires users to register if not already.
- ✓
Create a Conditional Access policy that requires MFA for all users
Why this is correct
Conditional Access can require MFA; existing registered users can use their methods.
- ✗
Enable security defaults
Why it's wrong here
Security defaults enforce MFA but also require registration if not done.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
MFA
Multi-Factor Authentication (MFA) is a security method that requires a user to verify their identity using two or more different types of evidence, such as a password plus a code from a phone, before they can access an account or system.
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
About these practice questions
One of 241 original MS-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MS-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Microsoft 365 Business Premium with Microsoft Entra ID P1. You have 200 users. You need to enforce multi-factor authentication (MFA) for all users accessing the company's CRM application, which is a third-party SaaS app integrated via SAML. The CRM app does not support modern authentication protocols. You want to use a Microsoft solution that does not require additional licenses. What should you use?
easy- A.Enable security defaults in Microsoft Entra ID.
- B.Deploy Microsoft Entra application proxy for the CRM app.
- C.Configure per-user MFA for users of the CRM app.
- ✓ D.Create a Conditional Access policy targeting the CRM application and require MFA.
Why D: Conditional Access policies in Microsoft Entra ID P1 allow you to target specific cloud applications (including third-party SAML-integrated SaaS apps) and enforce MFA. Since the CRM app does not support modern authentication protocols, Conditional Access can still enforce MFA by requiring a compliant domain-joined device or by using app-enforced restrictions; however, the key is that Conditional Access works at the authentication plane and can require MFA even for legacy apps when combined with a capable authentication method like a one-time passcode or Microsoft Authenticator. This solution uses existing Microsoft Entra ID P1 licensing without additional costs.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.