Does a New MFA Provider Change the Usage Model?
Answer
Correct answer: B — Creating a new MFA provider from a backup cannot apply Per Enabled User, and new MFA providers can no longer be created.
Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements. Your company's Azure solution makes use of Multi-Factor Authentication for when users are not in the office. The Per Authentication option has been configured as the usage model. After the acquisition of a smaller business and the addition of the new staff to Azure Active Directory (Azure AD) obtains a different company and adding the new employees to Azure Active Directory (Azure AD), you are informed that these employees should also make use of Multi-Factor Authentication. To achieve this, the Per Enabled User setting must be set for the usage model. Solution: You create a new Multi-Factor Authentication provider with a backup from the existing Multi-Factor Authentication provider data. Does the solution meet the goal?
Community Insight
The question tests whether you know that an MFA provider's usage model is fixed at creation time and that Microsoft stopped allowing creation of new MFA providers on September 1, 2018, so the proposed restore-and-recreate solution cannot satisfy the Per Enabled User requirement.
This AZ-104 scenario asks whether creating a new Multi-Factor Authentication provider from a backup of existing provider data switches the tenant from the Per Authentication usage model to Per Enabled User. The answer is No, because new MFA providers can no longer be created and a restored provider still carries the original usage model setting.
Learners pick Yes, assuming that restoring a backup into a newly created MFA provider would let them choose the Per Enabled User model during setup — but the usage model is copied from the source data and cannot be changed afterward, and new providers cannot be created at all.
Community Discussion (70 comments)
Srikantha
👍 1
Selected: B
Reasoning: In Azure Active Directory (Azure AD / Microsoft Entra ID), once a Multi-Factor Authentication (MFA) Provider is created and its usage model (Per Authentication or Per Enabled User) is configured, the usage model cannot be changed. Furthermore, creating a new MFA provider from a backup of an existing provider does not change or convert the usage model. To switch usage models, you must create a new MFA Provider configured with the desired usage model (Per Enabled User) and re-register users or migrate them to conditional access policies / default Azure MFA configurations. (Note: Legacy MFA Providers have also been deprecated by Microsoft in favor of Azure AD / Microsoft Entra ID Conditional Access and Security Defaults).
d7dc3d1
👍 1
Selected: B
WHAT WILL BE THE SOLUTION FOR THIS?
Kabilanis
👍 10
Selected: B
Below are the possible options for this scenario. Consolidating here for easy read of subscribers. Solution: You reconfigure the existing usage model via the Azure portal. - No Solution: You reconfigure the existing usage model via the Azure CLI. - No Solution: You create a new Multi-Factor Authentication provider with a backup from the existing Multi-Factor Authentication provider data. - No
Gaja88
👍 6
Selected: B
No, creating a new MFA provider with restored data does not achieve the required usage model change. Why this doesn't work: - Azure no longer uses standalone MFA providers for most tenants. Microsoft has moved away from MFA providers toward license-based models, such as: Microsoft 365 E3/E5 Azure AD Premium P1/P2 - You cannot change the usage model (from per-authentication to per-user) by creating a new MFA provider. - Backing up and restoring from an MFA provider does not switch usage models, nor is this method supported for configuring modern Azure MFA scenarios. - Instead, the switch must be made by: Assigning appropriate Azure AD Premium licenses to users. Enforcing MFA through Conditional Access policies, or legacy per-user MFA settings (not recommended).
NicoVick
👍 1
Selected: B
B is good answer
victorio_27
👍 1
Selected: B
El modelo de uso de MFA en Azure AD está configurado como "Por autenticación", lo que significa que la autenticación multifactor se aplica según condiciones específicas, como cuando los usuarios acceden desde fuera de la oficina. El problema a resolver es que los nuevos empleados también deben cumplir con esta regla, por lo que la solución correcta sería actualizar la política de acceso condicional en Azure AD para incluirlos. Por qué la solución propuesta no cumple el objetivo: Crear un nuevo proveedor de autenticación multifactor con una copia de seguridad no es necesario ni relevante para este escenario. La configuración existente ya usa MFA basado en acceso condicional, por lo que la forma correcta de incluir a los nuevos empleados es modificando la política de acceso condicional en lugar de crear un nuevo proveedor de MFA.
58b2872
👍 3
Selected: B
you need to change it from per auth to per enabled
minura
👍 1
Selected: B
Answer B. No
Mark74
👍 1
Selected: B
It's B
asuarez
👍 7
Selected: B
Creating a new Multi-Factor Authentication provider with a backup from the existing provider data does not change the usage model from Per Authentication to Per Enabled User. You would need to specifically change the Multi-Factor Authentication settings to the Per Enabled User model to meet the requirements.
tsummey
👍 5
Selected: B
https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mfa-authprovider Important: Effective September 1st, 2018 new auth providers may no longer be created. Existing auth providers may continue to be used and updated, but migration is no longer possible. Multifactor authentication will continue to be available as a feature in Microsoft Entra ID P1 or P2 licenses.
BrkyUlukn
👍 1
answer is B NO Effective September 1st, 2018 new auth providers may no longer be created. Existing auth providers may continue to be used and updated, but migration is no longer possible. Multi-factor authentication will continue to be available as a feature in Azure AD Premium licenses. https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-authprovider
abhinav_4567
👍 3
Selected: B
b IS CORRECT
varinder82
👍 1
Final Answer: A (You can't change the usage model (per enabled user or per authentication) after an MFA provider is created.)
JPA210
👍 1
Yes , you can. Check the documentation again.
Amir1909
👍 1
Yes is correct
_gio_
👍 2
Selected: B
i think B
peterp007
👍 2
Answer -B (No) Effective September 1st, 2018 new auth providers may no longer be created. Existing auth providers may continue to be used and updated, but migration is no longer possible. Multifactor authentication will continue to be available as a feature in Microsoft Entra ID P1 or P2 licenses. https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mfa-authprovider
ggogel
👍 7
Selected: B
A would have been the correct answer, but as of 1st September 2018 MFA Providers are discontinued and can not be created anymore. As of today, the only way to use MFA is if the user has a license assigned that includes the MFA feature.
ef094b65596c14
👍 2
B. No, the solution does not meet the goal. Creating a new MFA provider does not directly address the requirement to change the MFA usage model from "Per Authentication" to "Per Enabled User." This change is typically done through configuration settings in the Azure portal or Azure AD PowerShell, not by creating a new MFA provider.
fiahbone
👍 2
Selected: A
Since usage model is immutable.
conip
👍 5
Selected: B
IMHO - A would be the option if you could still create new provider - as you cant (microsoft switches to inbuild/per license one) you can use that
GoldenDisciple2
👍 3
Selected: B
For some reason when I clicked reveal it showed A as the answer but it appears to be B after reading the comments and doing some research. Thanks for all the insight guys.
Souban07
👍 4
Selected: B
Effective September 1st, 2018 new auth providers may no longer be created. Existing auth providers may continue to be used and updated, but migration is no longer possible. Multi-factor authentication will continue to be available as a feature in Azure AD Premium licenses. https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-authprovider
redeyes21
👍 2
Answer is No (https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-authprovider)
picho707
👍 1
The answer is B since the proposed solution has the correct path, and at least one of the steps needed, but it is missing context and the rest of the steps.
Andre369
👍 2
Selected: B
No, the provided solution does not meet the goal of configuring the usage model for Multi-Factor Authentication (MFA) for the new employees added to Azure Active Directory (Azure AD) after the acquisition. Creating a new Multi-Factor Authentication provider with a backup from the existing Multi-Factor Authentication provider data does not directly address the requirement of setting the usage model to "Per Enabled User" for the new employees.
arieluchka
👍 1
you need to press the MFA on the tool bar on the left, not on the "getting started" page
BeauChateau
👍 3
Selected: B
To achieve the goal of enabling MFA for the new employees, the usage model of the existing MFA provider should be changed from "Per Authentication" to "Per Enabled User." This can be done by following the steps below: Sign in to the Azure portal. Navigate to Azure Active Directory > Security > MFA. Click on the "settings" tab. Change the usage model from "Per Authentication" to "Per Enabled User." Save the changes.
azureforsure
👍 1
Clicking on MFA in the Security blade links me to MS documentation on how MFA works: https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks
Madbo
👍 1
The solution described in the question does not meet the goal, so the answer is B. Creating a new Multi-Factor Authentication provider does not address the requirement of changing the usage model to Per Enabled User.
lokii9980
👍 2
It is not necessary to create a new Multi-Factor Authentication provider in this scenario. Instead, you can simply change the usage model from Per Authentication to Per Enabled User. This will enable Multi-Factor Authentication for all users in Azure AD, including the newly added employees. To change the usage model, follow these steps: Sign in to the Azure portal as a global administrator. Navigate to Azure Active Directory > Security > MFA. Click on the settings link at the top of the page. Under the usage model section, select the Per Enabled User option. Click on the Save button to apply the changes. Once the usage model has been updated, all users in Azure AD, including the new employees, will be required to use Multi-Factor Authentication. It is not necessary to create a new Multi-Factor Authentication provider, as the existing provider will continue to work with the updated usage model.
c154d26
👍 2
B is correct;as per documentation new auth providers can not be created.
maqibali
👍 3
Selected: A
A is the correct answer
kklohit
👍 2
Selected: B
No, the solution does not meet the goal. To enable Multi-Factor Authentication for the new employees, you need to change the usage model from "Per Authentication" to "Per Enabled User". Creating a new Multi-Factor Authentication provider with backup from the existing provider data will not change the usage model.
psr83
👍 2
Selected: B
https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-licensing
herodes
👍 3
Selected: B
B is correct
CommanderBigMac
👍 4
Seems the question itself is actually no longer relevant as creating Auth Providers is no longer even possible (Since 2018). Metrics for question also seems to be broken. A has a 27% vote, B has a 73% vote but both show as most voted.
walkaway
👍 22
Selected: B
It is a big NO now in 2023. If you still see this question, never say YES.
MacGyver83
👍 1
Selected: A
The answer is correct (yes).
rpalanivel83
👍 1
Answer : Yes You can't change the usage model (per enabled user or per authentication) after an MFA provider is created. If you purchased enough licenses to cover all users that are enabled for MFA, you can delete the MFA provider altogether. Ref: Check Manage your MFA provider secion from this link https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-authprovider
Rufusinski
👍 2
Selected: B
B is correct.
Cool_Z
👍 7
Selected: B
Effective September 1st, 2018 new auth providers may no longer be created. So option B(No) is the correct answer.
pamo
👍 3
Selected: B
https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-authprovider
FurnishedFlapjack
👍 8
Selected: B
Was A, now after 2018 is B
bobo1936
👍 4
Anser is B Important Effective September 1st, 2018 new auth providers may no longer be created. Existing auth providers may continue to be used and updated, but migration is no longer possible. Multi-factor authentication will continue to be available as a feature in Azure AD Premium licenses.
Ntinsky
👍 2
Selected: B
Agreed with Vein
FelixI
👍 3
Selected: B
Effective September 1st, 2018 new auth providers may no longer be created. Existing auth providers may continue to be used and updated, but migration is no longer possible. Multi-factor authentication will continue to be available as a feature in Azure AD Premium licenses.
NaoVaz
👍 3
Selected: B
This is outdated, like described in the official documentation: "Effective September 1st, 2018 new auth providers may no longer be created. Existing auth providers may continue to be used and updated, but migration is no longer possible. ". (https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-authprovider)
Igor_101
👍 2
Selected: B
Effective September 1st, 2018 new auth providers may no longer be created.
BigBigChannel
👍 1
B is correct
Diwakar_Reddy
👍 1
Selected: A
A is correct
cnduknthm
👍 1
please visit https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-authprovider. Effective September 1st, 2018 new auth providers may no longer be created.
Jemo21
👍 2
"You cannot change the usage model (per enabled user or per authentication) after an MFA provider is created." as per Microsoft documentation.
EmnCours
👍 1
Selected: A
Correct Answer: A
nm33
👍 2
Ans should be NO https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-authprovider Manage your MFA Provider If your MFA provider is not linked to an Azure AD tenant, or you link the new MFA provider to a different Azure AD tenant, user settings and configuration options are not transferred. Also, existing Azure MFA Servers need to be reactivated using activation credentials generated through the MFA Provider.
DenisRossi
👍 4
Selected: B
The Azure Portal has a disclaimer about it in the MFA section, and it says that is no longer possible to add other MFA provider since 1st September, 2018. So B - No is the correct answer.
Tyy27
👍 1
Selected: A
A is the correct answer
Pasmo
👍 1
Selected: A
Answer is A
ThieryLeLuronNadieline
👍 1
Vote for A
justauser
👍 4
Selected: B
No after 2018
Leti
👍 2
Selected: A
Vote A
AzureLearner76
👍 4
Selected: B
No new providers can be created after 2018
nqthien041292
👍 2
Selected: A
Vote A
MSExpert
👍 2
I'll go with B.
ant_man
👍 2
Selected: A
You can't change the usage model after an MFA provider is created
Prano
👍 1
Ans : A You cannot change the usage model after an MFA provider is created
Marski
👍 2
Isn't there official Microsoft docs guide on this? Like on the other questions. Just a thought.
AltHexMax
👍 2
https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-authprovider
Snownoodles
👍 6
"You cannot change the usage model (per enabled user or per authentication) after an MFA provider is created." Reference: https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-authprovider
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The requirement is that the newly acquired employees be billed under the Per Enabled User usage model, and the proposed solution is to create a new MFA provider restored from a backup of the existing provider's data. That fails on two counts: Microsoft's documentation states "You cannot change the usage model (per enabled user or per authentication) after an MFA provider is created," so a restored provider reproduces the original Per Authentication setting. It also fails because "Effective September 1st, 2018 new auth providers may no longer be created," which removes the entire mechanism the solution depends on. Therefore the solution does not meet the goal and the correct verdict is B.Why the Other Options Are Wrong
Option A (Yes) would require that a restored provider be allowed to declare a different usage model than its backup, which the platform forbids, and it would also require that new MFA providers still be creatable, which they are not. As several commenters noted, a solution variant such as "reconfigure the existing usage model via the Azure portal" is likewise answered No, because the setting is immutable once the provider exists. The modern path is licensing-based MFA through Microsoft Entra ID P1/P2 or Microsoft 365 E3/E5 rather than standalone providers, so none of the provider-creation approaches can deliver Per Enabled User billing. Since there are only two options and the goal is not met, only B remains.Community Comment Notes
Walkaway warns "It is a big NO now in 2023. If you still see this question, never say YES," and FurnishedFlapjack reports changing their own answer from A to B because post-2018 the scenario changed. Kabilanis helpfully consolidated the whole question family, listing the portal-reconfiguration, CLI-reconfiguration, and create-new-with-backup variants and answering No to each. Cool_Z and ggogel both pinpoint the September 1, 2018 cutoff for new auth providers, while Snownoodles supplies the exact immutability quote from the Microsoft docs, and Gaja88 adds that Microsoft has shifted tenants toward license-based MFA models.Official Reference
Exam Strategy
On this AZ-104 scenario family, always answer No unless the stated action is one the portal still permits today — creation and reconfiguration of MFA providers were retired in 2018, so any solution built on them cannot meet the goal.
Frequently Asked Questions
Why can't I switch an existing MFA provider from Per Authentication to Per Enabled User?
Microsoft documents that the usage model is locked at creation and cannot be changed afterward, so a restored or reconfigured provider keeps its original Per Authentication setting.
Can I still create a new Azure MFA provider in 2024?
No. Creation of new MFA providers stopped on September 1, 2018; MFA is now delivered through Microsoft Entra ID P1/P2 or Microsoft 365 licenses.
Related Analysis
Practice All AZ-104 Questions
Access 100 questions with complete answers and detailed explanations.
View Full AZ-104 Practice Test →