nerdexam
Microsoft

AZ-500 · Question #246

You work for an organization as an Azure administrator. There was an audit exercise that surfaced the fact that numerous privileged users have accounts without multi-factor authentication (MFA)…

The correct answer is D. Find the MFA alert on the recommendations tile in Security Center. To identify privileged users lacking multi-factor authentication after an audit, examine the recommendations tile in Azure Security Center (now Defender for Cloud) for specific MFA alerts.

Submitted by fatema_kw· Mar 6, 2026Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel

Question

You work for an organization as an Azure administrator. There was an audit exercise that surfaced the fact that numerous privileged users have accounts without multi-factor authentication (MFA) enabled. Now you need to filter out those privileged accounts on which MFA must be enabled. What would be your step of action?

Options

  • AUse Microsoft Graph API list credentialUserRegistrationDetails report and export the results to
  • BRun an LDAP query and export the results to CSV.
  • CRun the Get-MsolUser cmdlet and export the results to CSV.
  • DFind the MFA alert on the recommendations tile in Security Center.

How the community answered

(39 responses)
  • A
    3% (1)
  • B
    5% (2)
  • D
    92% (36)

Why each option

To identify privileged users lacking multi-factor authentication after an audit, examine the recommendations tile in Azure Security Center (now Defender for Cloud) for specific MFA alerts.

AUse Microsoft Graph API list credentialUserRegistrationDetails report and export the results to

While the Microsoft Graph API can retrieve user MFA registration details, finding a pre-aggregated alert in Azure Security Center is a more direct and often preferred method for administrators to act on known security posture issues.

BRun an LDAP query and export the results to CSV.

LDAP queries are primarily for on-premises Active Directory and are not used for directly querying Azure Active Directory or MFA status in Azure.

CRun the Get-MsolUser cmdlet and export the results to CSV.

The `Get-MsolUser` cmdlet is part of the deprecated MSOnline module, and modern Azure AD PowerShell cmdlets or Microsoft Graph API are preferred, but Security Center provides a more direct alert for this specific scenario.

DFind the MFA alert on the recommendations tile in Security Center.Correct

Azure Security Center (now Defender for Cloud) provides security recommendations, including alerts for privileged accounts that do not have multi-factor authentication (MFA) enabled, offering a centralized and actionable way for administrators to identify these users.

Concept tested: Azure Security Center (Defender for Cloud) security recommendations for MFA

Source: https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-500 Practice