nerdexam
Microsoft

AZ-104 · Question #395

Your company has an Azure Active Directory (Azure AD) tenant named contoso.com that is configured for hybrid coexistence with the on-premises Active Directory domain. The tenant contains the users…

The correct answer is D. User1, User2, User3, and User4. All listed user types, including Azure AD only, synced from on-premises AD, guest users, and cloud-only users, can be enabled for Azure Multi-Factor Authentication.

Submitted by satoshi_tk· Mar 4, 2026Manage Azure identities and governance

Question

Your company has an Azure Active Directory (Azure AD) tenant named contoso.com that is configured for hybrid coexistence with the on-premises Active Directory domain. The tenant contains the users shown in the following table. Whenever possible, you need to enable Azure Multi-Factor Authentication (MFA) for the users in contoso.com. Which users should you enable for Azure MFA?

Exhibits

AZ-104 question #395 exhibit 1
AZ-104 question #395 exhibit 2

Options

  • AUser1 only
  • BUser1, User2, and User3 only
  • CUser1 and User2 only
  • DUser1, User2, User3, and User4
  • EUser2 only

How the community answered

(37 responses)
  • B
    5% (2)
  • C
    8% (3)
  • D
    84% (31)
  • E
    3% (1)

Why each option

All listed user types, including Azure AD only, synced from on-premises AD, guest users, and cloud-only users, can be enabled for Azure Multi-Factor Authentication.

AUser1 only

This option excludes synced users, guest users, and cloud-only users (like User4), all of whom can use Azure MFA.

BUser1, User2, and User3 only

This option excludes User4, who is a cloud-only user and can be enabled for Azure MFA.

CUser1 and User2 only

This option excludes User3 (guest user) and User4 (cloud-only user), both of whom can be enabled for Azure MFA.

DUser1, User2, User3, and User4Correct

Azure Multi-Factor Authentication can be enabled for all user types in an Azure AD tenant, encompassing cloud-only users (User1, User4), users synced from on-premises AD (User2), and guest users (User3).

EUser2 only

This option excludes User1, User3, and User4, all of whom can be enabled for Azure MFA.

Concept tested: Azure MFA applicability to different user types

Source: https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks#mfa-user-states

Community Discussion

No community discussion yet for this question.

Full AZ-104 Practice