Microsoft 365 utilizes Azure Active Directory (Azure AD) for identity and access management, which includes Multi-Factor Authentication (MFA). Azure AD supports several verification methods to provide a second layer of security. The supported methods include the Microsoft Authenticator app, which can provide push notifications or one-time passcodes. Additionally, users can opt to receive a verification code via an SMS text message or an automated voice call to a pre-registered phone number. These three methods—app, text message, and phone call—are standard, configurable options for enhancing sign-in security.

B. While Windows Hello for Business uses biometrics, a generic biometric retinal scanner is not a natively supported verification method for Azure AD MFA.
D. Custom security questions are a verification method used for Self-Service Password Reset (SSPR), not as a second factor for Multi-Factor Authentication.

1. Microsoft Learn. (2023). Available verification methods for Azure Active Directory Multi-Factor Authentication. Microsoft Docs. Retrieved from https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks#available-verification-methods

Reference Details: The section "Available verification methods" explicitly lists "Microsoft Authenticator app

" "SMS

" and "Voice call" as supported methods. It also clarifies that "Security questions" are used for SSPR

not MFA.