Does a New MFA Provider Change the Usage Model?

AZ-104 By islever Editorial Last updated

Manage Microsoft Entra users and groups

Short answer

B Creating a new MFA provider from a backup cannot apply Per Enabled User, and new MFA providers can no longer be created.

Question

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if
the solution satisfies the requirements.
Your company's Azure solution makes use of Multi-Factor Authentication for when users are not in the office. The Per Authentication option has been configured
as the usage model.
After the acquisition of a smaller business and the addition of the new staff to Azure Active Directory (Azure AD) obtains a different company and adding the new
employees to Azure Active Directory (Azure AD), you are informed that these employees should also make use of Multi-Factor Authentication.
To achieve this, the Per Enabled User setting must be set for the usage model.
Solution: You create a new Multi-Factor Authentication provider with a backup from the existing Multi-Factor Authentication provider data.
Does the solution meet the goal?
  1. Yes
  2. No Correct Answer

Key Takeaways

The question tests whether you know that an MFA provider's usage model is fixed at creation time and that Microsoft stopped allowing creation of new MFA providers on September 1, 2018, so the proposed restore-and-recreate solution cannot satisfy the Per Enabled User requirement.

This AZ-104 scenario asks whether creating a new Multi-Factor Authentication provider from a backup of existing provider data switches the tenant from the Per Authentication usage model to Per Enabled User. The answer is No, because new MFA providers can no longer be created and a restored provider still carries the original usage model setting.

Common mistake: Learners pick Yes, assuming that restoring a backup into a newly created MFA provider would let them choose the Per Enabled User model during setup — but the usage model is copied from the source data and cannot be changed afterward, and new providers cannot be created at all.

Expert Analysis

Why the Answer Is Correct

The requirement is that the newly acquired employees be billed under the Per Enabled User usage model, and the proposed solution is to create a new MFA provider restored from a backup of the existing provider's data. That fails on two counts: Microsoft's documentation states "You cannot change the usage model (per enabled user or per authentication) after an MFA provider is created," so a restored provider reproduces the original Per Authentication setting. It also fails because "Effective September 1st, 2018 new auth providers may no longer be created," which removes the entire mechanism the solution depends on. Therefore the solution does not meet the goal and the correct verdict is B.

Why the Other Options Are Wrong

Option A (Yes) would require that a restored provider be allowed to declare a different usage model than its backup, which the platform forbids, and it would also require that new MFA providers still be creatable, which they are not. As several commenters noted, a solution variant such as "reconfigure the existing usage model via the Azure portal" is likewise answered No, because the setting is immutable once the provider exists. The modern path is licensing-based MFA through Microsoft Entra ID P1/P2 or Microsoft 365 E3/E5 rather than standalone providers, so none of the provider-creation approaches can deliver Per Enabled User billing. Since there are only two options and the goal is not met, only B remains.

Community Comment Notes

Walkaway warns "It is a big NO now in 2023. If you still see this question, never say YES," and FurnishedFlapjack reports changing their own answer from A to B because post-2018 the scenario changed. Kabilanis helpfully consolidated the whole question family, listing the portal-reconfiguration, CLI-reconfiguration, and create-new-with-backup variants and answering No to each. Cool_Z and ggogel both pinpoint the September 1, 2018 cutoff for new auth providers, while Snownoodles supplies the exact immutability quote from the Microsoft docs, and Gaja88 adds that Microsoft has shifted tenants toward license-based MFA models.

Official Reference

https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mfa-authprovider

This link opens the official vendor documentation in a new tab.

Exam Strategy

On this AZ-104 scenario family, always answer No unless the stated action is one the portal still permits today — creation and reconfiguration of MFA providers were retired in 2018, so any solution built on them cannot meet the goal.

Frequently Asked Questions

Why can't I switch an existing MFA provider from Per Authentication to Per Enabled User?

Microsoft documents that the usage model is locked at creation and cannot be changed afterward, so a restored or reconfigured provider keeps its original Per Authentication setting.

Can I still create a new Azure MFA provider in 2024?

No. Creation of new MFA providers stopped on September 1, 2018; MFA is now delivered through Microsoft Entra ID P1/P2 or Microsoft 365 licenses.

More AZ-104 FAQ →

Discussion 65 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 65

  1. walkaway 👍 22 Answered B
    It is a big NO now in 2023. If you still see this question, never say YES.
  2. Kabilanis 👍 10 Answered B
    Below are the possible options for this scenario. Consolidating here for easy read of subscribers. Solution: You reconfigure the existing usage model via the Azure portal. - No Solution: You reconfigure the existing usage model via the Azure CLI. - No Solution: You create a new Multi-Factor Authentication provider with a backup from the existing Multi-Factor Authentication provider data. - No
  3. FurnishedFlapjack 👍 8 Answered B
    Was A, now after 2018 is B
  4. asuarez 👍 7 Answered B
    Creating a new Multi-Factor Authentication provider with a backup from the existing provider data does not change the usage model from Per Authentication to Per Enabled User. You would need to specifically change the Multi-Factor Authentication settings to the Per Enabled User model to meet the requirements.
  5. ggogel 👍 7 Answered B
    A would have been the correct answer, but as of 1st September 2018 MFA Providers are discontinued and can not be created anymore. As of today, the only way to use MFA is if the user has a license assigned that includes the MFA feature.
Show 25 more comments
  1. Cool_Z 👍 7 Answered B
    Effective September 1st, 2018 new auth providers may no longer be created. So option B(No) is the correct answer.
  2. Gaja88 👍 6 Answered B
    No, creating a new MFA provider with restored data does not achieve the required usage model change. Why this doesn't work: - Azure no longer uses standalone MFA providers for most tenants. Microsoft has moved away from MFA providers toward license-based models, such as: Microsoft 365 E3/E5 Azure AD Premium P1/P2 - You cannot change the usage model (from per-authentication to per-user) by creating a new MFA provider. - Backing up and restoring from an MFA provider does not switch usage models, nor is this method supported for configuring modern Azure MFA scenarios. - Instead, the switch must be made by: Assigning appropriate Azure AD Premium licenses to users. Enforcing MFA through Conditional Access policies, or legacy per-user MFA settings (not recommended).
  3. Snownoodles 👍 6
    "You cannot change the usage model (per enabled user or per authentication) after an MFA provider is created." Reference: https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-authprovider
  4. tsummey 👍 5 Answered B
    https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mfa-authprovider Important: Effective September 1st, 2018 new auth providers may no longer be created. Existing auth providers may continue to be used and updated, but migration is no longer possible. Multifactor authentication will continue to be available as a feature in Microsoft Entra ID P1 or P2 licenses.
  5. conip 👍 5 Answered B
    IMHO - A would be the option if you could still create new provider - as you cant (microsoft switches to inbuild/per license one) you can use that
  6. Souban07 👍 4 Answered B
    Effective September 1st, 2018 new auth providers may no longer be created. Existing auth providers may continue to be used and updated, but migration is no longer possible. Multi-factor authentication will continue to be available as a feature in Azure AD Premium licenses. https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-authprovider
  7. bobo1936 👍 4
    Anser is B Important Effective September 1st, 2018 new auth providers may no longer be created. Existing auth providers may continue to be used and updated, but migration is no longer possible. Multi-factor authentication will continue to be available as a feature in Azure AD Premium licenses.
  8. CommanderBigMac 👍 4
    Seems the question itself is actually no longer relevant as creating Auth Providers is no longer even possible (Since 2018). Metrics for question also seems to be broken. A has a 27% vote, B has a 73% vote but both show as most voted.
  9. DenisRossi 👍 4 Answered B
    The Azure Portal has a disclaimer about it in the MFA section, and it says that is no longer possible to add other MFA provider since 1st September, 2018. So B - No is the correct answer.
  10. AzureLearner76 👍 4 Answered B
    No new providers can be created after 2018
  11. justauser 👍 4 Answered B
    No after 2018
  12. BeauChateau 👍 3 Answered B
    To achieve the goal of enabling MFA for the new employees, the usage model of the existing MFA provider should be changed from "Per Authentication" to "Per Enabled User." This can be done by following the steps below: Sign in to the Azure portal. Navigate to Azure Active Directory > Security > MFA. Click on the "settings" tab. Change the usage model from "Per Authentication" to "Per Enabled User." Save the changes.
  13. NaoVaz 👍 3 Answered B
    This is outdated, like described in the official documentation: "Effective September 1st, 2018 new auth providers may no longer be created. Existing auth providers may continue to be used and updated, but migration is no longer possible. ". (https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-authprovider)
  14. FelixI 👍 3 Answered B
    Effective September 1st, 2018 new auth providers may no longer be created. Existing auth providers may continue to be used and updated, but migration is no longer possible. Multi-factor authentication will continue to be available as a feature in Azure AD Premium licenses.
  15. GoldenDisciple2 👍 3 Answered B
    For some reason when I clicked reveal it showed A as the answer but it appears to be B after reading the comments and doing some research. Thanks for all the insight guys.
  16. pamo 👍 3 Answered B
    https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-authprovider
  17. 58b2872 👍 3 Answered B
    you need to change it from per auth to per enabled
  18. maqibali 👍 3 Answered A
    A is the correct answer
  19. abhinav_4567 👍 3 Answered B
    b IS CORRECT
  20. lokii9980 👍 2
    It is not necessary to create a new Multi-Factor Authentication provider in this scenario. Instead, you can simply change the usage model from Per Authentication to Per Enabled User. This will enable Multi-Factor Authentication for all users in Azure AD, including the newly added employees. To change the usage model, follow these steps: Sign in to the Azure portal as a global administrator. Navigate to Azure Active Directory > Security > MFA. Click on the settings link at the top of the page. Under the usage model section, select the Per Enabled User option. Click on the Save button to apply the changes. Once the usage model has been updated, all users in Azure AD, including the new employees, will be required to use Multi-Factor Authentication. It is not necessary to create a new Multi-Factor Authentication provider, as the existing provider will continue to work with the updated usage model.
  21. Andre369 👍 2 Answered B
    No, the provided solution does not meet the goal of configuring the usage model for Multi-Factor Authentication (MFA) for the new employees added to Azure Active Directory (Azure AD) after the acquisition. Creating a new Multi-Factor Authentication provider with a backup from the existing Multi-Factor Authentication provider data does not directly address the requirement of setting the usage model to "Per Enabled User" for the new employees.
  22. nm33 👍 2
    Ans should be NO https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-authprovider Manage your MFA Provider If your MFA provider is not linked to an Azure AD tenant, or you link the new MFA provider to a different Azure AD tenant, user settings and configuration options are not transferred. Also, existing Azure MFA Servers need to be reactivated using activation credentials generated through the MFA Provider.
  23. peterp007 👍 2
    Answer -B (No) Effective September 1st, 2018 new auth providers may no longer be created. Existing auth providers may continue to be used and updated, but migration is no longer possible. Multifactor authentication will continue to be available as a feature in Microsoft Entra ID P1 or P2 licenses. https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mfa-authprovider
  24. ef094b65596c14 👍 2
    B. No, the solution does not meet the goal. Creating a new MFA provider does not directly address the requirement to change the MFA usage model from "Per Authentication" to "Per Enabled User." This change is typically done through configuration settings in the Azure portal or Azure AD PowerShell, not by creating a new MFA provider.
  25. kklohit 👍 2 Answered B
    No, the solution does not meet the goal. To enable Multi-Factor Authentication for the new employees, you need to change the usage model from "Per Authentication" to "Per Enabled User". Creating a new Multi-Factor Authentication provider with backup from the existing provider data will not change the usage model.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Enable SSPR for Entra Identities

S-grade

Assigning Fabric Licenses in Entra ID Free Tenant

S-grade

Which Certificate from Vault1 for WebApp1 TLS?

S-grade

Does Storage Account Encryption Scope Contributor Role Allow Key Regeneration?

S-grade

Practice All AZ-104 Questions

Access 100 questions with complete answers and detailed explanations.

View Full AZ-104 Practice Test →

← Back to AZ-104 Study Guide