Azure Multi-Factor Authentication (MFA), now part of Microsoft Entra, enhances security by requiring two or more verification methods. The supported methods provide a second layer of security to user sign-ins and transactions. The three primary and most common methods available for users to verify their identity are receiving an automated voice call to a registered phone, receiving a text message (SMS) with a verification code, and using the Microsoft Authenticator app for a push notification or a verification code. These methods represent different factors of authentication ("something you have," like a phone) to secure access.

C. email verification: Email is considered a less secure method and is primarily used for Self-Service Password Reset (SSPR), not as a second factor for MFA during sign-in.

E. security question: Security questions are a "something you know" factor, similar to a password, and are used for SSPR, not for the multi-factor authentication process during sign-in.

1. Microsoft Learn. (2023). What authentication and verification methods are available in Microsoft Entra ID? Microsoft Docs. Retrieved from https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-methods.

Reference Details: The table under the section "Methods and their strengths" explicitly lists "SMS" and "Voice call" as usable for MFA. It also lists "Microsoft Authenticator" as a primary method for MFA. The same table indicates that "Email OTP" and "Security questions" are only usable for Self-Service Password Reset (SSPR).

2. Microsoft Learn. (2023). How it works: Microsoft Entra multifactor authentication. Microsoft Docs. Retrieved from https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mfa-howitworks.

Reference Details: The section "Available verification methods" lists the following options: "Microsoft Authenticator

" "Windows Hello for Business

" "FIDO2 security key

" "OATH hardware token (preview)

" "OATH software token

" "SMS

" and "Voice call." This list confirms the correct answers and omits email and security questions as MFA methods.