MS-102 Deploy and manage a Microsoft 365 tenant Practice Question
You are a Microsoft 365 administrator for a small business with 50 users. The company uses Microsoft 365 Business Premium. You need to ensure that all users have multi-factor authentication (MFA) enabled. The company does not have any custom conditional access policies. You want to implement MFA as quickly as possible with minimal configuration. What should you do?
⚠ Common exam trap
Many candidates confuse the MFA registration campaign (which only prompts registration) with actual MFA enforcement, or they overcomplicate the solution by choosing per-user MFA or a custom conditional access policy when security defaults are the fastest and simplest answer for a tenant with no existing policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable security defaults in the Microsoft Entra admin center.
Security defaults provide a pre-configured set of security policies, including requiring MFA for all users, that can be enabled with a single toggle in the Microsoft Entra admin center. This is the fastest and simplest method for a small business with no existing conditional access policies, as it requires minimal configuration and immediately enforces MFA for every user.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable security defaults in the Microsoft Entra admin center.
Why this is correct
Security defaults in the Microsoft Entra admin center enforces MFA for every user, blocks legacy authentication, and requires users to complete MFA registration on first sign-in — all with a single toggle and no conditional access policy creation. For a small business without granular exclusion requirements, this is the fastest and most minimal-configuration path to satisfy the scenario. Microsoft recommends security defaults for tenants that do not have Microsoft Entra ID P1/P2 licenses, and even with Business Premium it provides immediate baseline protection without policy dependencies.
- ✗
Configure MFA registration campaign for all users.
Why it's wrong here
Configuring an MFA registration campaign only prompts users to register their authentication methods; it does not force MFA at sign-in, so users who ignore the prompts remain unenforced. While the campaign can be targeted to specific groups or all users, its purpose is to increase registration rates, not to enforce a second factor. Therefore, this option fails the requirement to actually require MFA for all users, making it incorrect in this scenario.
- ✗
Enable per-user MFA for each user.
Why it's wrong here
Enabling per-user MFA (legacy per-user MFA) toggles MFA on each individual account, but Microsoft has deprecated this configuration in favor of security defaults or conditional access. It requires toggling each user's state to Enabled or Enforced, which is time-consuming and error-prone in a small business, and it does not block legacy authentication. Per-user MFA also produces a poor user experience because prompts occur inconsistently, and Microsoft recommends migrating away from it, so this option is incorrect for a modern, minimal-effort solution.
- ✗
Create a conditional access policy that requires MFA for all users.
Why it's wrong here
Creating a conditional access policy requires additional configuration steps and dependencies, such as licensing for Microsoft Entra ID P1 (included in Business Premium), but the scenario demands the *fastest* implementation with *minimal* configuration. The correct approach is to enable security defaults, which instantly enforces MFA for all users without any policy creation. This option is tempting because conditional access policies are the standard tool for granular MFA control in larger environments, and would be correct if the organisation needed to exclude specific users or applications.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
Key term
Security defaults
Security defaults is a set of basic security settings in Microsoft Entra ID that automatically enables common protections like multifactor authentication for all users in a tenant.
About these practice questions
This MS-102 question is part of Courseiva's 241-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.