Explanation:
In Microsoft Entra ID (Azure AD), Security Defaults is a built-in baseline security configuration that enforces basic identity protection, such as requiring all users to register for multi-factor authentication (MFA) using the Microsoft Authenticator app. When security defaults are enabled, users cannot select alternate MFA methods (like SMS or phone call).
According to the Microsoft SC-300 Official St udy Guide and Azure AD Identity Protection documentation , only administrators with elevated security roles-specifically the Security Administrator, Global Administrator, or Conditional Access Administrator-can enable or disable security defaults.
Here's the detailed reasoning:
* User1 (Security Administrator): This role can manage identity security settings, including modifying MFA configurations and security defaults.
* User2 (Privileged Authentication Administrator): This role can reset MFA details for other users but cannot modify tenant-wide MFA or security default settings.
* User3 (Service Support Administrator): This role is limited to viewing service health and support tickets and has no permissions to modify security configurations.
Since User2 is restricted by security defaults (which enforce Microsoft Authenticator only), the only way to allow alternative MFA methods is to disable or customize security defaults. That configuration must be done by User1 (Security Administrator).
Microsoft Documentation: " To enable or disable security defaults, you must be a Global Administrator, Security Administrator, or Conditional Access Administrator."