AZ-700 Question 114
Select 2Your organization has deployed a line-of-business web app secured with Azure Active Directory (Azure AD). Several remote employees report that they can sign in successfully from corporate laptops on the internal network, but receive 'token validation' errors when attempting to authenticate from personal devices at home. Which two of the following actions should you take first to diagnose and resolve the client-side authentication issue?
- A
Check the Azure AD sign-in logs for any conditional access failures or token-related errors on personal devices
- B
Enable an 'Obtain new token' policy in Windows Registry on the personal device
- C
Verify that the personal devices have correct system time and date settings to ensure valid token timestamps
- D
Disable multi-factor authentication (MFA) for all users in Azure AD to eliminate potential token mismatches
Show answer and explanation
Correct answers: A, C
Explanation
Client-side authentication errors often stem from misconfiguration of device settings or conditional access policies. Checking Azure AD sign-in logs provides visibility into sign-in attempts and reasons for failures, while correcting system clock issues ensures token timestamps are valid. For more information, refer to the official Microsoft documentation on troubleshooting Azure Active Directory sign-in issues: https://learn.microsoft.com/azure/active-directory/authentication/howto-azure-ad-sign-in-logs.
- A. Correct.
Correct. Reviewing the Azure AD sign-in logs can reveal whether a conditional access policy or token validation error is preventing remote sign-ins for personal devices. These logs often contain detailed error messages that help pinpoint the cause of authentication failures.
- B. Incorrect.
Incorrect. There is no direct 'Obtain new token' policy in Windows Registry for Azure AD authentication. This option is not a valid troubleshooting step, as Azure AD token acquisition is handled by built-in mechanisms and client-side libraries, not by a standalone registry setting.
- C. Correct.
Correct. Token validation errors frequently arise if the local machine's clock is inaccurate, causing token time stamps to fall outside the allowed range. Ensuring that the device's system time and date are correct is a standard troubleshooting step for authentication.
- D. Incorrect.
Incorrect. Disabling MFA for all users is neither necessary nor recommended for resolving routine token validation problems. It introduces security risks and does not address the underlying issue�MFA is unlikely to be the root cause of personal device authentication failures.