Which two auth methods enable passwordless Entra sign-in to a Linux VM?

Why the Answer Is Correct

The scenario requires three things at once: sign-in to VM1 with Microsoft Entra credentials, out-of-band multi-factor authentication, and no password anywhere in the flow. The Microsoft Authenticator app (A) supports passwordless phone sign-in and delivers the approval prompt out-of-band to a separate registered device, so an attacker who has only the VM session or a password cannot complete it. FIDO2 security keys (B) are likewise a supported passwordless method for Entra ID sign-in on Azure VMs: the user presents the key instead of a password, the key-bound Entra credential identifies the user, and the possession factor satisfies the MFA requirement. Neither method ever transmits a reusable password to VM1, which is exactly what the third bullet forbids. That is why A and B form the two valid, complete solutions the question asks for.

Why the Other Options Are Wrong

Temporary Access Pass (C) is a time-limited onboarding and recovery code used to bootstrap a user into passwordless methods or register a credential; it is deliberately not a standing sign-in method for routine VM access. SMS (D) is out-of-band, but it functions only as an additional verification step on top of a password-based first factor, so it directly contradicts the requirement to prevent password sign-in, and it is not a supported primary method for Azure VM sign-in. Windows Hello for Business (E) is a Windows client technology tied to Windows Hello-capable hardware and the Windows sign-in experience; VM1 runs Linux, so it cannot be included in this solution at all. Each of C, D and E therefore fails at least one of the three stated requirements.

Community Comment Notes

All three commenters converged on the same verdict without dissent in the 100-vote record. Matt19 put it plainly, writing that the "MS Authenticator app allows passwords sign-ins and FIDO2 is for sure correct" — the first fragment is a typo for passwordless sign-in, which is precisely the property both methods share. TRN80 endorsed that reasoning, stating that "Matt19 is correct the answer should be A+B", and 59e8fdb added the short confirmation "A+B for sure!". The consensus is useful because it highlights the discriminating criterion exam writers rely on here: the method must be passwordless AND validated for Azure VM sign-in, not merely a second factor. No commenter attempted to defend SMS or Temporary Access Pass, which matches the analysis above.

Answer Statement Recap

Correct answer: A, B — include the Microsoft Authenticator app and FIDO2 security keys in the VM1 solution.