One compromised account, three in the morning
Karan, a newly specialized security engineer, got paged at 3am: a user account had signed in from a country the company had no employees in, and immediately tried to access finance systems. The account did have MFA enabled, technically, but the specific method configured, SMS text codes, was exactly the weak point that let an attacker through via a SIM-swap. SC-900 had taught Karan that MFA exists. This incident taught him that not all MFA is equally resistant to attack.
Not all authentication methods resist the same attacks
SMS and voice call codes are convenient but vulnerable to SIM-swapping and interception. The Microsoft Authenticator app with push notifications is stronger, but still vulnerable to "MFA fatigue" attacks, an attacker repeatedly triggering prompts until an exhausted user approves one by mistake. Number matching in the Authenticator app closes that specific gap, requiring the user to enter a number shown on the sign-in screen, not just tap approve. FIDO2 security keys and passkeys go further still, phishing-resistant by design, since they're cryptographically bound to the legitimate site and simply won't work against a convincing fake one.
Conditional Access: not just a concept, an actual control you configure
SC-900 introduced Conditional Access as an idea, if this condition, then this requirement. SC-500 is where Karan actually builds the policy: requiring compliant devices for finance system access, blocking sign-ins entirely from countries with no legitimate business presence, and requiring stronger authentication specifically for high-risk sign-ins rather than applying the same friction to every login regardless of risk.
Password protection: blocking the passwords attackers already have
Microsoft Entra Password Protection blocks users from setting passwords that appear on known breach lists or match custom banned terms, the company name and common variations, for instance. This closes a different gap than MFA: MFA helps once a password has already been guessed or leaked; password protection helps prevent the weak or reused password in the first place.
Check your understanding
Five questions, all from this module. Get 4 out of 5 to mark it complete.
1. What made SMS-based MFA the weak point in the 3am incident?
2. What does number matching in the Authenticator app specifically defend against?
3. What makes FIDO2 security keys and passkeys phishing-resistant?
4. What is the difference between how SC-900 and SC-500 treat Conditional Access?
5. What gap does Microsoft Entra Password Protection close that MFA does not?