Your Microsoft 365 tenant includes the Microsoft Intune Suite and you manage Windows 11 devices with Intune. You must implement passwordless sign-in that enforces number-matching. Which authentication method should you choose?

Microsoft Authenticator is the correct choice because it supports number matching for passwordless sign-in, which is a strong multifactor authentication (MFA) method. Number matching enhances security by requiring users to enter a number displayed on the sign-in screen into their Authenticator app, preventing accidental approvals of push notifications. Voice calls and text messages are less secure alternatives as they are susceptible to phishing and SIM-swapping attacks. FIDO2 security keys provide strong passwordless authentication but do not inherently enforce number matching as a primary mechanism; their security relies on the physical presence of the key and user interaction (e.g., PIN or biometric).