An organization wants to prevent phishing-resistant authentication bypass for users accessing Azure Machine Learning. They require authentication methods that cannot be intercepted by adversary-in-the-middle attacks. Which Conditional Access setting enforces this requirement?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because Microsoft Entra ID Conditional Access supports Authentication Strength policies, which specify exactly which MFA methods are acceptable. Phishing-resistant MFA methods—specifically FIDO2 security keys and Windows Hello for Business—use public-key cryptography bound to the origin site, making them immune to adversary-in-the-middle (AiTM) attacks that can steal session tokens after MFA.
Full explanation below image
Full Explanation
B is correct because Microsoft Entra ID Conditional Access supports Authentication Strength policies, which specify exactly which MFA methods are acceptable. Phishing-resistant MFA methods—specifically FIDO2 security keys and Windows Hello for Business—use public-key cryptography bound to the origin site, making them immune to adversary-in-the-middle (AiTM) attacks that can steal session tokens after MFA. A is wrong because allowing any MFA method (including TOTP, SMS, or push notifications) permits methods that are vulnerable to AiTM phishing attacks via real-time phishing proxies. C is wrong because compliant device requirement enforces device health, not the MFA method's resistance to phishing; combined with a weak MFA method it remains vulnerable. D is wrong because sign-in risk policies trigger MFA reactively when risk is detected; they do not proactively enforce phishing-resistant methods on all sign-ins.