You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: learn-pr/wwl-sci/manage-implement-authentication-methods/2-explore-authentication-methods.yml
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -5,7 +5,7 @@ metadata:
5
5
title: Explore Microsoft Entra ID Authentication Methods
6
6
description: Explore the spectrum of Microsoft Entra ID authentication methods, from password-based to passwordless, and understand authentication strength and security hierarchy.
Copy file name to clipboardExpand all lines: learn-pr/wwl-sci/manage-implement-authentication-methods/3-configure-mfa.yml
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -5,7 +5,7 @@ metadata:
5
5
title: Configure Multi-Factor Authentication in Microsoft Entra ID
6
6
description: Learn how to deploy and configure multi-factor authentication (MFA) in Microsoft Entra ID using Conditional Access policies, named locations, and secure user registration.
Copy file name to clipboardExpand all lines: learn-pr/wwl-sci/manage-implement-authentication-methods/4-implement-passwordless-authentication.yml
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -5,7 +5,7 @@ metadata:
5
5
title: Implement Passwordless Authentication in Microsoft Entra ID
6
6
description: Learn how to deploy Windows Hello for Business, passkeys in Microsoft Authenticator, and FIDO2 security keys in Microsoft Entra ID — and match each method to the right user persona.
Copy file name to clipboardExpand all lines: learn-pr/wwl-sci/manage-implement-authentication-methods/5-configure-self-service-password-reset.yml
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -5,7 +5,7 @@ metadata:
5
5
title: Configure Self-Service Password Reset in Microsoft Entra ID
6
6
description: Learn how to deploy and configure self-service password reset (SSPR) in Microsoft Entra ID — including licensing requirements, SSPR-eligible authentication methods, registration enforcement, password writeback, and activity monitoring.
Copy file name to clipboardExpand all lines: learn-pr/wwl-sci/manage-implement-authentication-methods/6-exercise-configure-authentication-methods.yml
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -5,7 +5,7 @@ metadata:
5
5
title: "Exercise - Configure Authentication Methods in Microsoft Entra ID"
6
6
description: "Hands-on exercise: enable the MFA registration policy in Identity Protection, require MFA for cloud admin portals using Conditional Access, and enable phishing-resistant sign-in with passkeys (FIDO2) in Microsoft Entra ID."
Copy file name to clipboardExpand all lines: learn-pr/wwl-sci/manage-implement-authentication-methods/7-knowledge-check.yml
+10-10Lines changed: 10 additions & 10 deletions
Original file line number
Diff line number
Diff line change
@@ -5,7 +5,7 @@ metadata:
5
5
title: Module assessment
6
6
description: "Knowledge check"
7
7
ms.date: 03/05/2026
8
-
author: roberts
8
+
author: r-c-stewart
9
9
ms.author: roberts
10
10
ms.topic: unit
11
11
module_assessment: true
@@ -18,25 +18,25 @@ quiz:
18
18
choices:
19
19
- content: "SMS one-time passcode"
20
20
isCorrect: false
21
-
explanation: "SMS OTP is susceptible to SIM-swapping and real-time phishing attacks, so it does not qualify as phishing-resistant."
21
+
explanation: "SMS OTP is susceptible to SIM-swapping and real-time phishing attacks, so it doesn't qualify as phishing-resistant."
22
22
- content: "FIDO2 security key"
23
23
isCorrect: true
24
24
explanation: "FIDO2 security keys use public-key cryptography bound to the origin, making them resistant to phishing and credential replay attacks."
25
25
- content: "OATH hardware token"
26
26
isCorrect: false
27
-
explanation: "OATH TOTP codes are time-based passcodes that can be intercepted and replayed by a phishing site, so they are not phishing-resistant."
27
+
explanation: "OATH TOTP codes are time-based passcodes that are often intercepted and replayed by a phishing site, so they aren't phishing-resistant."
28
28
- content: "A security architect is designing MFA enforcement for all users in a Microsoft Entra ID tenant. Which mechanism does Microsoft recommend over per-user MFA or security defaults for most organizations?"
29
29
choices:
30
-
- content: "Enabling security defaults in the Entra admin center"
30
+
- content: "Enabling security defaults in the Microsoft Entra admin center"
31
31
isCorrect: false
32
-
explanation: "Security defaults are a baseline for organizations without a Microsoft Entra ID P1/P2 license and do not offer the granular control that most organizations need."
32
+
explanation: "Security defaults are a baseline for organizations without a Microsoft Entra ID P1/P2 license and don't offer the granular control that most organizations need."
33
33
- content: "Enabling per-user MFA for every account"
34
34
isCorrect: false
35
35
explanation: "Per-user MFA is a legacy approach that lacks the context-awareness and flexibility of modern policy-driven enforcement."
36
36
- content: "Using Conditional Access policies to require MFA"
37
37
isCorrect: true
38
-
explanation: "Conditional Access is the recommended MFA enforcement mechanism because it allows granular, risk- and context-based rules that can target specific users, apps, and conditions."
39
-
- content: "A company is deploying passwordless authentication. Frontline workers share physical kiosks in a warehouse and do not have assigned Windows laptops. Which passwordless method is the best fit for this persona?"
38
+
explanation: "Conditional Access is the recommended MFA enforcement mechanism because it allows granular, risk-based, and context-based rules that can target specific users, apps, and conditions."
39
+
- content: "A company is deploying passwordless authentication. Frontline workers share physical kiosks in a warehouse and don't have assigned Windows laptops. Which passwordless method is the best fit for this persona?"
40
40
choices:
41
41
- content: "Windows Hello for Business"
42
42
isCorrect: false
@@ -54,18 +54,18 @@ quiz:
54
54
explanation: "The Microsoft Authenticator app code (TOTP) is a supported SSPR method that users can register and use to verify their identity during a reset."
55
55
- content: "FIDO2 security key / passkey"
56
56
isCorrect: true
57
-
explanation: "FIDO2 security keys and passkeys are sign-in-only credentials. They can confirm a sign-in but are not available as verification methods during a self-service password reset flow."
57
+
explanation: "FIDO2 security keys and passkeys are sign-in-only credentials. They can confirm a sign-in but aren't available as verification methods during a self-service password reset flow."
58
58
- content: "Email address verification"
59
59
isCorrect: false
60
60
explanation: "Email is a supported SSPR method and is commonly used as an alternate contact verification option."
61
61
- content: "A help desk technician needs to onboard a new employee who has no existing authentication methods registered. The technician wants to issue a short-lived credential that lets the employee securely complete first-time MFA registration. Which feature is designed for this purpose?"
62
62
choices:
63
63
- content: "Send a password"
64
64
isCorrect: false
65
-
explanation: "Sending a password does not provide a secure, time-limited credential for first-time authentication registration."
65
+
explanation: "Sending a password doesn't provide a secure, time-limited credential for first-time authentication registration."
66
66
- content: "A Conditional Access policy scoped to the 'Register security information' user action"
67
67
isCorrect: false
68
-
explanation: "This policy controls who can register, but it does not itself provide a credential that allows an unregistered user to authenticate for the first time."
68
+
explanation: "This policy controls who can register, but it doesn't itself provide a credential that allows an unregistered user to authenticate for the first time."
69
69
- content: "Temporary Access Pass (TAP)"
70
70
isCorrect: true
71
71
explanation: "TAP is a time-limited passcode issued by an admin that allows a user with no existing methods to sign in and bootstrap their first MFA registration, including passkeys and FIDO2 keys."
Copy file name to clipboardExpand all lines: learn-pr/wwl-sci/manage-implement-authentication-methods/includes/5-configure-self-service-password-reset.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -45,7 +45,7 @@ Key policy guidance:
45
45
46
46
## Enforce registration and configure password writeback
47
47
48
-
:::image type="content" source="../media/sspr-flow.png" alt-text="Activity flow diagram showing the SSPR user journey: user goes to aka.ms/sspr, verifies identity with registered methods, sets a new password, and writeback updates on-premises Active Directory when configured.":::
48
+
:::image type="content" source="../media/password-reset-flow.png" alt-text="Activity flow diagram showing the SSPR user journey: user goes to aka.ms/sspr, verifies identity with registered methods, sets a new password, and writeback updates on-premises Active Directory when configured.":::
49
49
50
50
Use Conditional Access targeting **Register security information** to enforce registration. For first-time users or recovery scenarios, issue a **Temporary Access Pass (TAP)** to bootstrap secure enrollment.
Copy file name to clipboardExpand all lines: learn-pr/wwl-sci/manage-implement-authentication-methods/index.yml
+2-2Lines changed: 2 additions & 2 deletions
Original file line number
Diff line number
Diff line change
@@ -4,7 +4,7 @@ metadata:
4
4
title: Manage and Implement Authentication Methods in Microsoft Entra ID
5
5
description: "Learn to plan, deploy, and manage secure authentication in Microsoft Entra ID. This module covers authentication methods, MFA with Conditional Access, passwordless options, and self-service password reset."
0 commit comments