A new starter receives a corporate laptop but has no existing credential and must register a FIDO2 security key for passwordless sign-in on their first day, without a help desk agent setting a temporary password. Which Microsoft Entra authentication method should an administrator issue so the user can complete onboarding and register the key?
- AIssue a Temporary Access Pass so the new starter signs in with the time-limited passcode and then registers the FIDO2 security key from My Sign-Ins. Correct
- BIssue a self-service password reset link so the new starter can set an initial password and then enrol the FIDO2 security key from My Sign-Ins.
- CIssue an OATH hardware token so the new starter signs in with the rotating code and then registers the FIDO2 security key from My Sign-Ins.
- DIssue a Microsoft Authenticator push registration so the new starter approves a prompt and then registers the FIDO2 security key from My Sign-Ins.
Why A is correct: A Temporary Access Pass is a time-limited passcode designed to onboard users with no existing credential so they can register passwordless methods such as a FIDO2 key, matching the requirement exactly.
Why B is wrong: Self-service password reset still produces a password-based credential and assumes the user already has a registered method to verify, so it does not bootstrap a brand new account cleanly.
Why C is wrong: An OATH hardware token is a second factor that supplements a password; it cannot serve as the primary bootstrap credential for an account that has no password set yet.
Why D is wrong: Registering Authenticator itself needs an existing verified credential to start the flow, so it cannot be the first method handed to an account that has nothing registered.