nerdexam
Microsoft

AZ-104 · Question #395

Your company has an Azure Active Directory (Azure AD) tenant named contoso.com that is configured for hybrid coexistence with the on-premises Active Directory domain. The tenant contains the users sho

The correct answer is D. User1, User2, User3, and User4. All listed user types, including Azure AD only, synced from on-premises AD, guest users, and cloud-only users, can be enabled for Azure Multi-Factor Authentication.

Submitted by satoshi_tk· Mar 4, 2026Manage Azure identities and governance

Question

Your company has an Azure Active Directory (Azure AD) tenant named contoso.com that is configured for hybrid coexistence with the on-premises Active Directory domain. The tenant contains the users shown in the following table. Whenever possible, you need to enable Azure Multi-Factor Authentication (MFA) for the users in contoso.com. Which users should you enable for Azure MFA?

Exhibits

AZ-104 question #395 exhibit 1
AZ-104 question #395 exhibit 2

Options

  • AUser1 only
  • BUser1, User2, and User3 only
  • CUser1 and User2 only
  • DUser1, User2, User3, and User4
  • EUser2 only

How the community answered

(37 responses)
  • B
    5% (2)
  • C
    8% (3)
  • D
    84% (31)
  • E
    3% (1)

Why each option

All listed user types, including Azure AD only, synced from on-premises AD, guest users, and cloud-only users, can be enabled for Azure Multi-Factor Authentication.

AUser1 only

This option excludes synced users, guest users, and cloud-only users (like User4), all of whom can use Azure MFA.

BUser1, User2, and User3 only

This option excludes User4, who is a cloud-only user and can be enabled for Azure MFA.

CUser1 and User2 only

This option excludes User3 (guest user) and User4 (cloud-only user), both of whom can be enabled for Azure MFA.

DUser1, User2, User3, and User4Correct

Azure Multi-Factor Authentication can be enabled for all user types in an Azure AD tenant, encompassing cloud-only users (User1, User4), users synced from on-premises AD (User2), and guest users (User3).

EUser2 only

This option excludes User1, User3, and User4, all of whom can be enabled for Azure MFA.

Concept tested: Azure MFA applicability to different user types

Source: https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks#mfa-user-states

Community Discussion

No community discussion yet for this question.

Full AZ-104 Practice