MFA Exclusions for RMS Connector and Scanner
You have a Microsoft 365 E5 subscription that contains a Windows 11 device named Device1 and three users named User1, User2, and User3. You plan to deploy Azure information Protection (AIP) and the Microsoft Purview information Protection client to Device1. You need to ensure that the users can perform the following actions on Device1 as part of the planned deployment: • User1 will test the functionality of the client. • User2 will install and configure the Microsoft Rights Management connector. • User3 will be configured as the service account for the information protection scanner. The solution must maximize the security of the sign-in process for the users. What should you do?
Community Insight
The exam tests the specific limitation that the Microsoft Purview Information Protection scanner and Rights Management connector do not support MFA, requiring their associated service accounts to be exempted.
This question addresses the security configuration of Azure Information Protection components, specifically identifying which accounts must be excluded from multifactor authentication to ensure service functionality. The correct approach prioritizes operational compatibility over universal MFA enforcement for non-interactive service accounts.
Candidates often select passkey or passwordless authentication (Option D) because it represents the 'most secure' general principle, failing to recognize that these specific legacy or background services cannot authenticate with modern MFA methods.
Community Discussion (9 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The correct action is to exclude User2 and User3 from multifactor authentication (MFA). According to Microsoft documentation, the Rights Management connector and the Microsoft Purview Information Protection scanner do not support MFA. User2 installs/configures the connector, and User3 is the service account for the scanner; both roles rely on non-interactive or automated authentication flows that break if MFA is enforced. Excluding them ensures the services function correctly.Why the Other Options Are Wrong
Option A is incorrect because excluding User1 (who is testing the client interactively) reduces security without any technical necessity. Option B is incorrect because while passwordless is more secure, it may not be supported by the scanner's authentication mechanism depending on the implementation, and the primary requirement is MFA exclusion for compatibility. Option D is incorrect because enabling passkeys for all users assumes full compatibility, but the scanner and connector explicitly fail with MFA-enforced sign-ins, making this option operationally invalid despite its high security posture.Community Comment Notes
Community consensus heavily favors excluding MFA for the service accounts. As user Eltooth noted, "User 3 (service account) can only run with a complex password and NO MFA." Multiple commenters cited official Microsoft docs stating that the scanner and connector "don't support MFA," confirming that User2 and User3 must be excluded to prevent service failure.Official Reference
Exam Strategy
Always check for technical limitations of specific Azure/Purview services before applying general security best practices like MFA. If a service documentation states it does not support MFA, you must exclude those specific accounts, even if it seems less secure than other options.
Frequently Asked Questions
Why can't the scanner use passwordless auth?
The scanner relies on specific service authentication mechanisms that are incompatible with interactive MFA prompts required by most passwordless methods.
Does User1 need MFA exclusion?
No, User1 is an interactive tester using the client normally, so they should retain MFA for maximum security as per standard policy.