Configuring Multi-Factor Authentication Flashcards
How can you access MFA settings in the Azure Portal?
By browsing to Azure Active Directory, and then to MFA.
What are some configuration options available in MFA settings?
Account lockout, block and unblock users, and other key configuration options.`
What does the account lockout setting do?
Temporarily locks out accounts in the MFA service if too many denied authentication attempts are detected.
What is the purpose of the block/unblock settings?
o manually prevent certain users on an on-prem MFA Server from receiving MFA requests.
What is the fraud alert feature used for?
Configuring settings related to users’ ability to report fraudulent verification requests from an on-prem MFA server.
What does the caching rules feature do?
Allows subsequent verification requests to succeed automatically if the user succeeds the first verification.
What can you view in the server status settings?
The status of on-prem MFA servers, including version, status, IP, and last communication time and date.
Where can you find the activity report?
Under “Manage MFA Server” for on-prem MFA Server implementations.
How many authentication methods are required by default for SSPR?
One authentication method is required by default.
How can you require users to register when they sign in for SSPR?
On the Registration page, select the option to require users to register when they sign in.
What is the self-service password reset URL?
The self-service password reset URL is https://aka.ms/sspr/.
How can you disable self-service password reset?
In the Azure AD portal, go to Password Reset, select none under self-service password reset enabled, and save the settings.
What type of sign-ins are displayed in the sign-ins report?
The sign-ins report displays interactive sign-ins where users have manually signed in using their username and password.
What information is shown in the default list view of the sign-ins report?
The default list view shows the sign-in date, related user, application signed into, sign-in status, conditional access status, and MFA requirements status.
How can you customize the view of the sign-ins report?
By clicking on “Columns” at the top, you can customize the view of the sign-ins report.
What information is displayed in the Basic Info tab of a specific sign-in?
The Basic Info tab shows user information, IP address of the sign-in, sign-in location, sign-in date, and client app used for the sign-in.
: Can you view device-specific information for a sign-in?
Yes, by clicking on “Device Info,” you can see details about the specific device used for the sign-in, such as the operating system and browser.
How can you determine if a sign-in required MFA or conditional access?
The MFA tab in the sign-ins report indicates whether MFA was required for the sign-in, and the same goes for conditional access.
What options are available at the top of the sign-ins report?
You can view your info with Power BI and download the report if needed.
What can an administrator do with Azure MFA in the cloud regarding user and device settings?
An administrator can manage user and device settings, such as requiring users to re-provide their contact methods, deleting app passwords, and requiring MFA on all trusted devices.
What happens when an administrator requires users to re-provide their contact methods in Azure MFA?
Requiring users to re-provide their contact methods forces them to complete the MFA registration process again. Non-browser apps that the user has access to will continue to work unless the user has app passwords for them.
How can an administrator delete a user’s app passwords in Azure MFA?
y checking the box next to “delete all existing app passwords generated by the selected users,” an administrator can delete a user’s app passwords. This action will cause any non-browser apps associated with the deleted app passwords to stop working until a new app password is created.
What does it mean to mark devices as trusted in Azure MFA?
Allowing users to mark devices as trusted permits them to opt out of two-step verification for a specified number of days on their regular devices.
Why would an administrator want to restore Multi-Factor Authentication on all remembered devices?
If an account is compromised or a trusted device is lost, an administrator may need to remove the trusted status and require two-step verification again. By checking the box for “restore Multi-Factor Authentication on all remembered devices,” an administrator can accomplish this.
