Azure MFA for Credential Encryption During Deployment

AZ-900 By islever Editorial Last updated

Describe Azure identity, access, and security

Short answer

B Azure MFA does not encrypt credentials; Azure Key Vault is required for secure storage and encryption of secrets.

Question

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if
the solution satisfies the requirements.
You have been informed by your superiors of the company's intentions to automate server deployment to Azure. There is, however, some concern that
administrative credentials could be uncovered during this process.
You are required to make sure that during the deployment, the administrative credentials are encrypted using a suitable Azure solution.
Solution: You recommend the use of Azure Multi-Factor Authentication (MFA).
Does the solution meet the goal?
  1. Yes
  2. No Correct Answer

Key Takeaways

The question tests the distinction between identity governance and data security; the trap is assuming any 'security' feature like MFA protects stored secrets, whereas Key Vault is required for encryption.

This question evaluates whether Azure Multi-Factor Authentication (MFA) can encrypt administrative credentials during automated server deployment. The correct answer is B, as MFA is an authentication control, not a data protection service.

Common mistake: Many learners choose A because they associate 'security' with MFA without reading the specific requirement for 'encryption' of credentials. They confuse access control with data confidentiality.

Expert Analysis

Why the Answer Is Correct

The solution does not meet the goal because Azure Multi-Factor Authentication (MFA) is designed to verify user identity during login, not to store or encrypt secrets. MFA adds a second factor to authentication but provides no mechanism for protecting the confidentiality of administrative credentials themselves during deployment. To encrypt and securely store these credentials, you must use a dedicated secrets management service like Azure Key Vault.

Why the Other Options Are Wrong

Option A is incorrect because it validates a flawed technical premise. MFA cannot encrypt data; it only challenges the user for additional proof of identity. Using MFA would leave the plaintext credentials exposed in scripts or configuration files, defeating the purpose of encryption.

Community Comment Notes

Community consensus strongly supports Option B. Users like jgalanj noted that the keyword 'credentials' points directly to Key Vault. Dennx clarified that "MFA adds an aditional layer to the authentication process, but it doesn't keep your credential safe." Another commenter emphasized that "Key Vault will protect credentials," highlighting the correct architectural component for this scenario.

Official Reference

https://docs.microsoft.com/en-us/azure/key-vault/general/overview

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a question asks about securing passwords, keys, or certificates, immediately think of Azure Key Vault. Do not confuse it with Azure Active Directory features like MFA or Conditional Access, which handle who gets in, not what data is protected.

Frequently Asked Questions

Why isn't MFA enough to secure credentials?

MFA verifies identity at login but does not store or encrypt the actual password or key. It prevents unauthorized access but leaves the secret itself unprotected if compromised elsewhere.

What Azure service should I use instead of MFA for secrets?

Use Azure Key Vault. It is a centralized service for managing secrets, keys, and certificates, providing encryption and strict access controls.

More AZ-900 FAQ →

Discussion 34 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 34

  1. jgalanj 👍 62
    key word = concern that administrative CREDENTIALS could be uncovered during this process = Key Vault
  2. Dennx 👍 38
    MFA adds an aditional layer to the authentication process, but it doesn't keep your credential safe.
  3. BeauChateau 👍 14 Answered B
    No, the recommended solution of Azure Multi-Factor Authentication (MFA) does not encrypt administrative credentials during server deployment to Azure. MFA is a solution that adds an additional layer of authentication to the login process, and it can help prevent unauthorized access to resources. To encrypt administrative credentials during server deployment to Azure, a better solution would be to use Azure Key Vault. Azure Key Vault is a cloud-based service that provides secure storage of keys, secrets, and certificates. By storing the administrative credentials in Azure Key Vault, they can be encrypted and protected from unauthorized access.
  4. azzaa 👍 7
    MFA is authenticating a login. Key Vault will protect credentials
  5. nikee000 👍 5
    Answer is Correct. It should be Azure Key Vault. Azure Key Vault is a secure secrets store, providing management for secrets, keys, and certificates, all backed by Hardware Security Modules Source: https://docs.microsoft.com/en-us/azure/key-vault/general/overview
Show 25 more comments
  1. MissLuka 👍 5
    I just passed, a variation of MFA question was there so I recommend you guys to review it as I had 5 questions concerning MFA, SSO and autorization
  2. glhs 👍 5
    B is correct. A vault solution is needed
  3. shadeey 👍 4
    Correct!
  4. JG990 👍 3 Answered B
    MFA is used to authenticate the user not to secure your credentials.
  5. himanshu_90677 👍 3
    Azure key vault
  6. kahla 👍 2 Answered B
    Azure MFA enhances login security by requiring multiple verification steps but does not encrypt or securely store administrative credentials during automated deployments. To protect credentials during deployment, Azure Key Vault should be used.
  7. LePastore 👍 2 Answered B
    No. The solution is to use Azure Key Vault. MFA is a security policy implemented for user login.
  8. Said Ismail 👍 2 Answered B
    . The solution is to use Azure Key Vault. MFA is a security policy implemented for user login.
  9. intentando 👍 2 Answered B
    https://learn.microsoft.com/es-es/entra/identity/authentication/concept-mfa-howitworks
  10. Insanewhip 👍 2
    B is the correct answer. The solution should be Azure Key Vault.
  11. GeeKaizer1 👍 2
    Answer is No, it should be Key Vault
  12. ElPitu97 👍 2 Answered B
    no key vault correct answer
  13. rameshsee 👍 2
    Selected Answer: B
  14. Mahanad 👍 1 Answered B
    Azure Multi-Factor Authentication (MFA) adds an extra layer of security by requiring users to verify their identity using two or more authentication methods. It does not encrypt administrative credentials during automated server deployment. The appropriate solution is Azure Key Vault, which securely stores and manages passwords, secrets, encryption keys, and certificates.
  15. arjunyv2022 👍 1 Answered B
    Azure Multi-Factor Authentication (MFA) is for user authentication and not for encrypting administrative credentials, the solution does not meet the goal. Instead, Azure Key Vault should be used for secure credential management
  16. Kanders 👍 1
    B. No - does not meet goal due to MFA is used to add authentication layer for user access, not to encrypt credentials. Correct solution is Azure Key Vault.
  17. AlekksMaciel 👍 1 Answered B
    O MFA adiciona uma camada adicional ao processo de autenticação, mas não mantém sua credencial segura.
  18. chartanalyst 👍 1
    https://docs.microsoft.com/en-us/azure/virtual-machines/infrastructure-automation
  19. tojatin 👍 1 Answered B
    Use azure Key Vault https://docs.microsoft.com/en-us/azure/vpn-gateway/design
  20. deyson 👍 1 Answered B
    No, completly unrelated. This is a great example to use Azure Key-Vaults
  21. xxx_111_yyy_222 👍 1 Answered A
    key vault to encrypt credentials
  22. maysonazure 👍 1
    MFA does not encrypt passwords.
  23. cnuila 👍 1 Answered B
    Correct Answer is key Vault
  24. islacks 👍 1 Answered B
    should be azure key-vault
  25. Zaidsdb 👍 1 Answered B
    only the azure key vault

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Azure Resource Locks for RG Protection

S-grade

Shared Responsibility in Azure SaaS

S-grade

Accessing Azure Cloud Shell via Web Browser

S-grade

Azure VM High Availability SLA Requirements

S-grade

Practice All AZ-900 Questions

Access 90 questions with complete answers and detailed explanations.

View Full AZ-900 Practice Test →

← Back to AZ-900 Study Guide