Question
You have a Microsoft 365 E5 subscription that contains a Windows 11 device named Device1 and three users named User1, User2, and User3.
You plan to deploy Azure Information Protection (AIP) and the Microsoft Purview Information Protection client to Device1.
You need to ensure that the users can perform the following actions on Device1 as part of the planned deployment:
- User1 will test the functionality of the client.
- User2 will install and configure the Microsoft Rights Management connector.
- User3 will be configured as the service account for the information protection scanner.
The solution must maximize the security of the sign-in process for the users.
What should you do?
- A. Exclude User1 and User2 from multifactor authentication (MFA).
- B. Enable User2 and User3 for passwordless authentication.
- C. Exclude User2 and User3 from multifactor authentication (MFA). Correct
- D. Enable User1, User2, and User3 for passkey (FIDO2) authentication.
Explanation
The Rights Management connector does not support MFA, so the account that installs and configures it (User2) must not require MFA. The service account that runs the information protection scanner (User3) runs non-interactively and must not require MFA either. User1 only tests the client interactively and can keep MFA, which keeps sign-in as secure as possible. Passwordless or passkey (FIDO2) sign-in still needs an interactive user, so it does not work for these accounts.
