Explanation:
< User1 can join four additional Windows 10 devices to Azure AD. # No
2## Admin1 can set "Devices to be Azure AD joined or Azure AD registered require Multi-Factor Authentication" to Yes. # Yes
3## Admin2 is a local administrator on Device3. # No
This scenario draws from Module: Manage device identities in Azure Active Directory in the Microsoft SC-
300 Official Study Guide and Microsoft Learn content.
In the Device Settings, the "Maximum number of devices per user" is configured as 5. User1 already has one Azure AD joined device (Device1) and three Azure AD registered devices (Device2, Device3, Device4).
Since both Azure AD joined and Azure AD registered devices count toward the same limit, User1 has already registered 4 devices. This means they can add only one more, not four additional Windows 10 devices.
Therefore, the statement is No.
Microsoft documentation states: "The maximum number of devices per user setting applies collectively to all Azure AD-joined and Azure AD-registered devices." The Cloud Device Administrator role (Admin1's role) has the delegated permissions to manage device settings in Azure AD, including enforcing MFA requirements for device registration and join operations. The role allows management of the Azure AD device configuration blade, including toggling settings like MFA for join/register, join limits, and device ownership policies. Therefore, Admin1 can enable the MFA requirement for device join/registration.
As per Microsoft Learn: "Cloud Device Administrator can manage all aspects of device settings, including device join and registration MFA requirements." Admin2 holds the Device Administrator role. However, per Microsoft's documentation, only Azure AD- joined Windows 10 devices grant local administrator rights to users in the Device Administrator role. Azure AD-registered devices (such as Device3) are personal devices that do not have local administrator assignment through Azure AD roles. Since Device3 is Azure AD registered, not joined, Admin2 is not a local admin on it.
Microsoft guidance clarifies: "Users assigned to the Device Administrator role are added as local administrators only on Azure AD-joined devices, not on Azure AD-registered or hybrid devices."