A municipal security program’s phishing-resistant roadmap starts by requiring stronger sign-in for all Microsoft 365 users. Which foundational control should come first in that identity story?
Select an answer to reveal the explanation.
Short Explanation
Before fancy architecture debates, make every Microsoft 365 sign-in harder than a stolen password. MFA everywhere is that foundation. Phishing-resistant journeys still start with killing password-only access.
Full Explanation
Multifactor authentication (MFA) everywhere for Microsoft 365 is the foundational control that should come first when a municipal security program’s phishing-resistant roadmap starts by requiring stronger sign-in for all users. MFA immediately reduces account-takeover risk from stolen passwords and creates the baseline on which more advanced phishing-resistant methods can later mature. For city-wide identity hardening, MS-900 treats MFA as primary identity protection rather than as an optional afterthought.
Turning off Entra ID logging so attackers have fewer audit events is the opposite of good security practice. Publishing all admin passwords in a public SharePoint site for convenience is a critical anti-pattern. Replacing MFA with unmanaged legacy mail protocols as the preferred sign-in path weakens protection and expands attack surface.
An exam caveat is that phishing-resistant authenticators are a stronger long-term destination, but “start with MFA for all Microsoft 365 users” remains the correct fundamentals first step in this roadmap framing. Operationally, enforce MFA tenant-wide for municipal users, block or discourage basic authentication where applicable, monitor registration completion, and only then plan stronger authenticator upgrades for high-risk roles.