Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Single Sign-On Access with Microsoft Entra ID
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An organization uses multiple cloud-based applications and software services across different departments. Employees currently have to maintain and enter distinct usernames and passwords for each application, resulting in frequent password fatigue, sign-in friction, and increased support requests.
Which authentication method should the IT administrator configure in Microsoft Entra ID (Azure AD) to enable users to access all authorized applications using a single set of credentials?
Explanations
Role-Based Access Control (RBAC)
Role-Based Access Control (RBAC)
What Role-Based Access Control (RBAC) Is
Role-Based Access Control (RBAC) is an authorization mechanism used to manage permissions and restrict resource access based on assigned organizational roles (such as Owner, Contributor, Reader, or Application Administrator).
Why It Doesn't Meet the Requirement
- RBAC determines what actions a user or identity is permitted to perform on resources after they have been authenticated; it is not an authentication method.
- RBAC does not enable users to sign in to multiple applications with a single credential.
Key Characteristics and Limitations
- Governs authorization, not authentication: Deals with access rights rather than identity verification.
- Fine-grained permission assignment: Assigns specific privileges over subscriptions, resource groups, or application registrations.
- Separation of duties: Ensures users only receive the minimum necessary privileges to perform their jobs.
This Answer Would Be Correct If
The scenario focused on assigning specific administrative permissions (such as the Cloud Application Administrator role) to delegate the management of enterprise applications and cloud resources.
Additional Context
Administrators use RBAC roles within Microsoft Entra ID to configure enterprise application settings and SSO integrations, but RBAC itself is not the sign-in technology used by end users.
Conditional Access session controls
Conditional Access session controls
What Conditional Access Session Controls Are
Conditional Access session controls are real-time policy evaluation tools that govern and monitor user interactions within cloud applications during an active session, often integrating with tools like Microsoft Defender for Cloud Apps to prevent data exfiltration.
Why It Doesn't Meet the Requirement
- Session controls provide post-authentication monitoring and data protection; they do not establish user identity or federate logins across systems.
- They cannot replace independent sign-in prompts or enable single-credential authentication across multiple business applications.
Key Characteristics and Limitations
- Evaluates real-time risk: Monitors downloads, uploads, and activities during active sessions.
- Extends Conditional Access: Applies granular governance rules after initial user authentication succeeds.
- Data protection focus: Designed to prevent sensitive corporate data leaks rather than simplify end-user login experiences.
This Answer Would Be Correct If
The organization wanted to monitor active application sessions in real time and restrict the downloading of confidential files when accessed from unmanaged devices.
Additional Context
Conditional Access policies and session controls build upon Microsoft Entra SSO configurations to protect corporate data, but they do not provide the underlying single sign-on mechanism.
Multi-Factor Authentication (MFA)
Multi-Factor Authentication (MFA)
What Multi-Factor Authentication (MFA) Is
Multi-Factor Authentication (MFA) is a security mechanism that requires users to provide two or more distinct verification factors to prove their identity during the sign-in process, such as something they know (password), something they have (authenticator app notification or security key), and something they are (biometrics).
Why It Doesn't Meet the Requirement
- MFA enhances sign-in security by adding verification layers, but it does not consolidate logins across disparate software applications.
- Without single sign-on (SSO), enabling MFA alone would actually increase login prompts across every independent system rather than streamlining access with one set of credentials.
Key Characteristics and Limitations
- Focuses on verification strength: Designed to mitigate credential theft and unauthorized account access rather than reducing credential count.
- Requires additional verification prompts: Users must confirm additional factors during sign-in challenges.
- Complementary to SSO: MFA is frequently layered on top of SSO to secure the primary identity provider authentication flow.
This Answer Would Be Correct If
The organization required users to supply a secondary verification method, such as a mobile app prompt or temporary passcode, in addition to their password to prove their identity securely.
Additional Context
While MFA is critical for cloud security and can be enforced during SSO authentication flows, it does not provide single-credential access across multiple applications on its own.
Single sign-on (SSO)
Single sign-on (SSO)
What Single Sign-On (SSO) Is
Single sign-on (SSO) is an identity and access management method that enables users to authenticate once with a single set of login credentials (such as a corporate username and password) and gain access to multiple connected applications and services without needing to re-authenticate separately for each one.
How It Meets the Organization's Requirements
- Unified credential access: With SSO configured in Microsoft Entra ID (formerly Azure Active Directory), users log in once and can open any authorized enterprise cloud or on-premises application without re-entering credentials.
- Elimination of credential sprawl: Users no longer need to create or remember different passwords for individual applications, eliminating password fatigue and reducing support tickets for credential resets.
- Centralized identity management: Administrators can manage user permissions and access from a single identity provider while providing seamless application access via portals such as Microsoft My Apps.
Key Advantages and Capabilities
- Multiple integration protocols: Supports modern federation protocols such as SAML 2.0, OpenID Connect, and WS-Federation, as well as password-based vaulting for legacy web apps.
- Improved productivity: Minimizes time spent repeatedly logging in throughout the workday.
- Enhanced security controls: Enables centralized enforcement of Conditional Access policies and session controls across all connected applications.
- Simplified offboarding: Revoking or disabling an employee's central Entra ID account instantly cuts off their access to all linked downstream applications.
Why This Is Optimal
SSO is specifically designed to solve the problem of multiple independent logins by delegating authentication to a central identity provider, making it the most direct and effective solution for the organization's requirements.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Passwordless Authentication
Describe authentication methods in Azure, including single sign-on (SSO), multifactor authentication (MFA), and passwordless
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Conditional Access Policies
Describe authentication methods in Azure, including single sign-on (SSO), multifactor authentication (MFA), and passwordless
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Entra Conditional Access
Describe authentication methods in Azure, including single sign-on (SSO), multifactor authentication (MFA), and passwordless
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
FIDO2 Security Keys for Shared Workstations
Describe authentication methods in Azure, including single sign-on (SSO), multifactor authentication (MFA), and passwordless
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Shared Responsibility Model Physical Security
Describe the shared responsibility model
AdvancedAZ-104 Microsoft Azure Administrator Exam
Availability Zones High Availability
Deploy virtual machines to availability zones and availability sets
Last updated Validated