This scenario is based on how Azure AD Multi-Factor Authentication (MFA) statuses transition between Disabled , Enabled , and Enforced states, as documented in the Microsoft SC-300: Microsoft Identity and Access Administrat or Study Guide and Microsoft Learn - Configure and deploy MFA in Azure Active Directory .
Let's analyze the details step-by-step using the exhibits:
* Initial MFA Configuration (February 1, 2021)
* User1: Disabled
* User2: Enabled
* User3: Enforced
* MFA Policy Setting
* "Allow users to remember multi-factor authentication on devices they trust" is enabled .
* "Number of days users can trust devices for" is 20 days . This means that once a user completes MFA on a trusted device, they won't be prompted again for 20 days on that same device.
* User Sign-in Activity:
* User1: Signs in on Feb 2 and again on Feb 21
* User2: Signs in on Feb 5
* User3: Already in Enforced state (so continuous MFA enforcement applies) State Transitions per Microsoft Documentation:
* Disabled: User cannot register or use MFA.
* Enabled: User is registered for MFA but not yet required at every sign-in. Once they complete registration, they remain Enabled until admin enforces it.
* Enforced: User must use MFA at every sign-in.
Timeline Evaluation:
* User1 wa s initially Disabled , so even though they sign in multiple times (Feb 2 and Feb 21), MFA remains disabled unless the admin manually changes the setting - therefore, User1 = Disabled .
* User2 was Enabled on Feb 1, and signed in on Feb 5 - this allows them to register for MFA (move from Enabled # Enforced ) once registration completes. By Feb 26, they would be in Enforced state.
* User3 was already Enforced from the start, and their state remains unchanged.
Thus, by February 26, 2021 , the MFA status should be:
* Use r1: Disabled
* User2: Enforced
* User3: Enforced
This matches Option B exactly.
Microsoft references (Azure AD MFA Overview):
"Enabled users move to Enforced when they complete MFA registration. Enforced users must use MFA every time they sign in."