A security architect is designing identity controls for a multi-tenant SaaS AI application built on Azure. The application uses Microsoft Entra External ID (B2C) for customer authentication. The architect wants to enforce MFA for all customer sign-ins through a standard policy. Which Entra External ID feature provides this?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — c is correct because in Microsoft Entra External ID (B2C), user flows (formerly called policies) define the authentication journey for end users. MFA can be enforced within the user flow configuration, requiring customers to verify their identity with a second factor (such as email OTP or phone) as part of every sign-in journey.
Full explanation below image
Full Explanation
C is correct because in Microsoft Entra External ID (B2C), user flows (formerly called policies) define the authentication journey for end users. MFA can be enforced within the user flow configuration, requiring customers to verify their identity with a second factor (such as email OTP or phone) as part of every sign-in journey. This is the native mechanism for enforcing MFA in B2C consumer scenarios. A is wrong because Entra ID Protection sign-in risk policies are for enterprise Entra ID (B2B/workforce), not for B2C consumer identity tenants; B2C has its own identity protection features. B is wrong because standard Conditional Access in a resource tenant does not directly apply to B2C user authentication flows—B2C Conditional Access requires specific configuration within the B2C tenant. D is wrong because Named Location exclusions are for Conditional Access in the workforce tenant, not for B2C user flow MFA enforcement.