Subscription Owners still satisfy MFA with SMS, and a contractor replayed a text. How should the security engineer raise MFA quality for users who manage Azure without turning the item into an authenticator how-to?
Select an answer to reveal the explanation.
Short Explanation
SMS is a postcard—anyone who intercepts it can walk into Azure. For people who manage subscriptions, demand a stronger method or an authentication-strength grant on the Azure management Conditional Access policy, not another text message.
Full Explanation
Conditional Access can require specific authentication strengths or stronger authentication methods so SMS is no longer sufficient for privileged Azure management. When subscription Owners still satisfy MFA with SMS and a contractor replayed a text, the security engineer should require a stronger authentication method or an authentication strength grant for Azure management access—raising MFA quality without turning the answer into an authenticator app tutorial.
Disabling MFA registration and relying on password complexity fails by removing MFA entirely. Mandating SMS plus voice together as the only phishing-resistant combination fails by concept: stacking telephonic methods is not phishing-resistant authentication strength. Moving all Owner sign-ins to Azure AD B2C fails because B2C is a customer-identity platform, not the control plane for tightening workforce Owner MFA to Azure subscriptions.
Exam caveat: authentication strength policies can require phishing-resistant methods (passkeys, CWA, Hello for Business, and so on) for privileged management. Operational check: create or select an authentication strength that excludes SMS, attach it to the Azure-management Conditional Access grant, test an Owner sign-in, confirm SMS alone is rejected, and ensure break-glass procedure remains documented.