A vendor tells a municipal IT lead that passwords alone are enough for Microsoft 365 admin accounts. What should the candidate recommend instead as the foundational identity control?
Select an answer to reveal the explanation.
Short Explanation
Admin accounts are the master keys to city Microsoft 365. A password alone is a single point of failure; MFA adds another lock. That is the fundamentals answer when someone claims passwords are enough.
Full Explanation
MFA materially reduces account-takeover risk when passwords are phished, sprayed, or leaked, which is especially important for privileged Microsoft 365 admin accounts. MS-900 expects candidates to recognize MFA as a primary identity protection method rather than accepting password-only advice. Removing Entra ID, using document libraries, or Forms quizzes does not replace multifactor authentication for admins.