Describe the capabilities of Microsoft Entra →hardMultiple ChoiceObjective-mapped

SC-900 Describe the capabilities of Microsoft Entra Practice Question

Exhibit

Refer to the exhibit.

```kusto
SigninLogs
| where UserPrincipalName == "user@contoso.com"
| where Status.errorCode == 50076
```

Refer to the exhibit. A security analyst runs the KQL query in Microsoft Sentinel. The query returns sign-in logs with error code 50076. What does this error indicate?

⚠ Common exam trap

Candidates often confuse the error code for failing MFA (50076) with the error code for being blocked by a Conditional Access policy (53003), because both involve MFA enforcement, but the error codes indicate different stages of the authentication flow.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The user did not pass multi-factor authentication.

Error code 50076 in Microsoft Entra sign-in logs specifically indicates that the user did not pass multi-factor authentication (MFA). This error is returned when the MFA challenge fails, such as when the user enters an incorrect verification code, denies the push notification, or the MFA session expires. It is a direct signal that the authentication attempt was not completed successfully due to MFA failure.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The user did not pass multi-factor authentication.
Why this is correct
Azure Active Directory (Azure AD) sign-in logs use specific error codes to indicate the reason for a failed authentication attempt. Error code 50076 specifically signifies that the user failed to complete the multi-factor authentication (MFA) challenge required for access. This could be due to the user not responding to the MFA prompt, entering an incorrect verification code, or declining the authentication request. Consequently, the sign-in attempt was unsuccessful because the mandatory second factor was not satisfied.
✗
The user account is disabled.
Why it's wrong here
A disabled user account in Azure Active Directory typically generates a different error code during a sign-in attempt, such as error code 50057. This specific error indicates that the user's account has been disabled by an administrator, preventing any authentication attempts. Since the KQL query result shows error code 50076, it clearly points away from an account being disabled as the root cause of the sign-in failure.
✗
The user's password has expired.
Why it's wrong here
When a user's password has expired in Azure Active Directory, the system typically returns error code 50053 during a sign-in attempt. This distinct error code informs the user that their credentials are no longer valid due to expiration and often prompts them to reset their password. As the KQL query output indicates error code 50076, it rules out an expired password as the reason for the authentication failure.
✗
The sign-in was blocked by a Conditional Access policy.
Why it's wrong here
A sign-in attempt blocked by an Azure Active Directory Conditional Access policy typically results in error code 53003. This error signifies that the access attempt violated a defined policy, such as requiring a compliant device, a specific location, or a managed application. Since the KQL query shows error code 50076, it indicates a failure specifically related to multi-factor authentication rather than a Conditional Access policy enforcement.

Go deeper

SC-900 Describe the capabilities of Microsoft Entra Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question