nerdexam
Microsoft

AZ-104 · Question #365

You have an Azure subscription named Subscription1 and two Azure Active Directory (Azure AD) tenants named Tenant1 and Tenant2. Subscription1 is associated to Tenant1. Multi-factor authentication…

The correct answer is C. Create and link a subscription to Tenant2. To enable MFA for users in a separate Azure AD tenant while maintaining existing MFA, a new subscription must first be created and linked to that specific tenant.

Submitted by kim_seoul· Mar 4, 2026Manage Azure identities and governance

Question

You have an Azure subscription named Subscription1 and two Azure Active Directory (Azure AD) tenants named Tenant1 and Tenant2. Subscription1 is associated to Tenant1. Multi-factor authentication (MFA) is enabled for all the users in Tenant1. You need to enable MFA for the users in Tenant2. The solution must maintain MFA for Tenant1. What should you do first?

Options

  • ATransfer the administration of Subscription1 to a global administrator of Tenant2
  • BConfigure the MFA Server setting in Tenant1.
  • CCreate and link a subscription to Tenant2.
  • DChange the directory for Subscription1.

How the community answered

(38 responses)
  • A
    5% (2)
  • B
    3% (1)
  • C
    79% (30)
  • D
    13% (5)

Why each option

To enable MFA for users in a separate Azure AD tenant while maintaining existing MFA, a new subscription must first be created and linked to that specific tenant.

ATransfer the administration of Subscription1 to a global administrator of Tenant2

Transferring the administration of Subscription1 to Tenant2 would disassociate it from Tenant1, potentially disrupting MFA for Tenant1 and violating the requirement to maintain its MFA.

BConfigure the MFA Server setting in Tenant1.

Configuring MFA Server settings in Tenant1 would only affect users within Tenant1 and has no impact on enabling MFA for users in Tenant2.

CCreate and link a subscription to Tenant2.Correct

Azure Multi-Factor Authentication is a tenant-level service, and its configuration and associated licensing are tied to an Azure subscription within a specific Azure AD tenant. To enable MFA for users in Tenant2, a subscription must be associated with Tenant2 to provision and manage the MFA service for that distinct tenant.

DChange the directory for Subscription1.

Changing the directory for Subscription1 would move it from Tenant1 to Tenant2, which would break MFA for Tenant1 users if it currently relies on that subscription for MFA services.

Concept tested: Azure AD MFA Tenant Association

Source: https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-104 Practice