Chapter 16, Implementing Multi-Factor Authentication

1. 1 and 3—Both, call to phone and notification via mobile apps don't require the user to enter a code in a browser.
2. 2—You should create a conditional access rule to allow users to use either MFA or a domain-joined device when accessing applications. The rule will not force MFA when using a domain-joined device.
3. 3—You should create a conditional access rule to require MFA authentication for all risky logins labeled medium-risk and above. Azure AD can apply risk levels to all sign-in attempts using a selection of parameters. You can use conditional access to enforce sign-in requirements based on those levels.