Multi-factor authentication in Azure - Step-by-Step Execution

Process Flow - Multi-factor authentication

User tries to sign in

↓

Enter username and password

↓

System verifies credentials

↓

Prompt for second factor

↓

User provides second factor

↓

System verifies second factor

↓

Access granted if both factors valid

↓

Access denied if any factor invalid

This flow shows how a user signs in with two steps: first password, then a second factor, to increase security.

Execution Sample

Azure

1. User enters username and password
2. System checks password
3. System prompts for second factor
4. User provides second factor
5. System verifies second factor
6. Access granted or denied

This sequence shows the step-by-step process of multi-factor authentication in Azure.

Process Table

Step	Action	Input	System Check	Result
1	User enters credentials	username + password	Verify password	Password valid
2	Prompt second factor	N/A	Wait for second factor	Prompt shown
3	User provides second factor	e.g. phone code	Verify second factor	Second factor valid
4	Grant access	N/A	Access control	Access granted
5	If any factor invalid	N/A	Access control	Access denied

💡 Access granted only if both password and second factor are valid; otherwise access denied.

Status Tracker

Variable	Start	After Step 1	After Step 3	Final
password_valid	false	true	true	true
second_factor_valid	false	false	true	true
access_granted	false	false	false	true

Key Moments - 2 Insights

Why does the system ask for a second factor after verifying the password?

Because verifying the password alone is not enough; the second factor adds extra security. See execution_table step 2 where the prompt happens after password validation.

What happens if the second factor is invalid?

Access is denied even if the password was correct. Refer to execution_table step 5 where invalid second factor leads to denial.

Visual Quiz - 3 Questions

Look at the execution table, what is the system's result after step 1?

A Password valid

B Password invalid

C Access granted

D Second factor requested

💡 Hint

Check the 'Result' column for step 1 in the execution_table.

At which step does the system verify the second factor?

A Step 1

B Step 3

C Step 2

D Step 4

💡 Hint

Look at the 'Action' and 'System Check' columns in the execution_table.

If the second factor is invalid, what will be the final access result?

A Access granted

B Prompt second factor again

C Access denied

D Password re-verified

💡 Hint

Refer to the last row in execution_table describing invalid factor outcome.

Concept Snapshot

Multi-factor authentication (MFA) requires two steps to sign in:
1. Enter username and password
2. Provide a second factor (like a phone code)
Both must be valid to grant access.
This adds extra security beyond just a password.

Full Transcript

Multi-factor authentication in Azure means users sign in with two steps. First, they enter their username and password. The system checks if the password is correct. If it is, the system asks for a second factor, such as a code from a phone app. The user provides this second factor. The system verifies it. If both the password and second factor are valid, access is granted. If either is invalid, access is denied. This process helps protect accounts by requiring more than just a password.

Practice

1. What is the main purpose of Multi-factor Authentication (MFA) in Azure?

easy

A. To provide free cloud storage

B. To speed up the login process

C. To allow users to reset their passwords automatically

D. To add an extra step to verify user identity for better security

Solution

1. Step 1: Understand MFA concept

   MFA requires users to provide two or more verification methods to prove their identity.

2. Step 2: Identify MFA's main goal

   This extra verification step improves security by making unauthorized access harder.

3. Final Answer:

   To add an extra step to verify user identity for better security -> Option D

4. Quick Check:

   MFA = extra verification step [OK]

Hint: MFA means more than one way to prove who you are [OK]

Common Mistakes:

• Thinking MFA speeds up login
• Confusing MFA with password reset
• Assuming MFA provides storage

2. Which of the following is the correct PowerShell command to enable MFA for a user in Azure AD?

easy

A. Set-MsolUser -UserPrincipalName [e-mail] -StrongAuthenticationRequirements @(@{RelyingParty="*";State="Enabled"})

B. Enable-MsolUser -UserPrincipalName [e-mail] -StrongAuthenticationRequirements @()

C. New-MsolUser -UserPrincipalName [e-mail] -EnableMFA $true

D. Add-MsolUser -UserPrincipalName [e-mail] -MFAEnabled

Solution

1. Step 1: Recall correct MFA enabling syntax

   In Azure AD PowerShell, enabling MFA uses Set-MsolUser with StrongAuthenticationRequirements set to enabled.

2. Step 2: Match command to syntax

   Set-MsolUser -UserPrincipalName [e-mail] -StrongAuthenticationRequirements @(@{RelyingParty="*";State="Enabled"}) correctly uses Set-MsolUser with StrongAuthenticationRequirements array containing State="Enabled".

3. Final Answer:

   Set-MsolUser -UserPrincipalName [e-mail] -StrongAuthenticationRequirements @(@{RelyingParty="*";State="Enabled"}) -> Option A

4. Quick Check:

   Enable MFA = Set-MsolUser + StrongAuthenticationRequirements enabled [OK]

Hint: Look for Set-MsolUser with StrongAuthenticationRequirements enabled [OK]

Common Mistakes:

• Using Enable-MsolUser which does not exist
• Confusing New-MsolUser with enabling MFA
• Using Add-MsolUser which is invalid

3. Consider this Azure AD MFA policy snippet:

{"state": "enabled", "methods": ["phoneAppNotification", "sms"]}

What happens when a user tries to sign in?

medium

A. User must use a hardware token only

B. User can sign in without any additional verification

C. User must verify identity using either phone app notification or SMS code

D. User is blocked from signing in

Solution

1. Step 1: Analyze MFA policy state

   The policy state is "enabled", so MFA is active and required.

2. Step 2: Check allowed verification methods

   Methods include phone app notification and SMS, so user can use either to verify.

3. Final Answer:

   User must verify identity using either phone app notification or SMS code -> Option C

4. Quick Check:

   MFA enabled means verification required via allowed methods [OK]

Hint: Enabled MFA means user must verify by one allowed method [OK]

Common Mistakes:

• Thinking user can skip verification
• Assuming user is blocked
• Believing only hardware tokens work

4. You configured MFA for a user but they report they are not prompted for the second factor. What is the most likely cause?

medium

A. The user is excluded from MFA in the conditional access policy

B. The user has not logged in for 30 days

C. The user's password is expired

D. The user is using a supported MFA method

Solution

1. Step 1: Understand why MFA prompt might be skipped

   If a user is excluded in conditional access policies, MFA won't be enforced for them.

2. Step 2: Evaluate other options

   Login inactivity or password expiry do not disable MFA prompts; supported methods enable MFA.

3. Final Answer:

   The user is excluded from MFA in the conditional access policy -> Option A

4. Quick Check:

   Exclusion in policy = no MFA prompt [OK]

Hint: Check if user is excluded in conditional access policies [OK]

Common Mistakes:

• Assuming password expiry disables MFA
• Thinking inactivity disables MFA
• Confusing supported methods with disabling MFA

5. You want to enforce MFA only when users access sensitive Azure resources from outside your corporate network. Which Azure feature should you use to achieve this?

hard

A. Enable MFA for all users unconditionally

B. Conditional Access policies with location-based conditions

C. Azure AD Identity Protection without conditions

D. Use Azure Firewall to block all external access

Solution

1. Step 1: Identify feature for conditional MFA enforcement

   Conditional Access policies allow setting MFA requirements based on conditions like user location.

2. Step 2: Match requirement to feature

   Location-based conditions in Conditional Access enable MFA only outside corporate network.

3. Step 3: Evaluate other options

   Identity Protection without conditions cannot target location; unconditional MFA applies everywhere; firewall blocks access but does not enforce MFA.

4. Final Answer:

   Conditional Access policies with location-based conditions -> Option B

5. Quick Check:

   Conditional Access + location = targeted MFA [OK]

Hint: Use Conditional Access with location rules for targeted MFA [OK]

Common Mistakes:

• Using unconditional MFA for all users
• Relying on Identity Protection without conditions
• Blocking access instead of enforcing MFA