Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Single Sign-On and Hybrid Identity with Entra ID
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An organization is migrating several corporate workloads to the cloud while retaining its on-premises Windows Server Active Directory infrastructure. The IT administration team must fulfill the following identity requirements:
- Provide employees with single sign-on (SSO) across Microsoft 365, cloud workloads, and third-party SaaS applications using a single organizational identity.
- Synchronize existing user accounts and security groups from the on-premises directory to the cloud.
Which service should the organization implement to meet these requirements?
Explanations
Microsoft Entra Domain Services
Microsoft Entra Domain Services
What Microsoft Entra Domain Services Is
Microsoft Entra Domain Services provides managed domain services such as domain join, Group Policy, Lightweight Directory Access Protocol (LDAP), and Kerberos/NTLM authentication in Azure without requiring the deployment and maintenance of dedicated domain controllers in virtual machines.
Why It Doesn't Meet the Requirement
Microsoft Entra Domain Services is designed to support legacy applications running in Azure virtual machines that require traditional Windows domain protocols. It is not the core identity provider that synchronizes on-premises AD DS accounts to the cloud or provides modern federation and SSO for SaaS applications.
Key Characteristics and Limitations
- Legacy Protocol Support: Focuses primarily on Kerberos, NTLM, and LDAP rather than modern web protocols such as OpenID Connect or SAML.
- Dependent on Microsoft Entra ID: It is a downstream service that synchronizes identity data from Microsoft Entra ID, not directly from an on-premises directory.
- Infrastructure Focus: Serves infrastructure-as-a-service (IaaS) workloads rather than SaaS and enterprise user authentication.
This Answer Would Be Correct If
The organization needed to join Azure virtual machines to a managed Active Directory domain to support legacy line-of-business applications using Kerberos or LDAP without managing domain controller virtual machines.
Microsoft Entra Privileged Identity Management (PIM)
Microsoft Entra Privileged Identity Management (PIM)
What Privileged Identity Management (PIM) Is
Microsoft Entra Privileged Identity Management (PIM) is an identity governance feature within Microsoft Entra ID (available with P2 licensing) that manages, controls, and monitors access to important resources across Azure, Microsoft Entra ID, and other Microsoft online services.
Why It Doesn't Meet the Requirement
PIM does not function as an independent directory service, nor does it establish directory synchronization or general user SSO. Its specific role is governance over high-privilege roles to reduce security exposure.
Key Characteristics and Limitations
- Just-In-Time (JIT) Access: Enables users to activate privileged roles only when necessary rather than maintaining permanent administrative access.
- Approval and Justification Workflows: Enforces approval requirements, multi-factor authentication, and business justifications before role elevation.
- Access Reviews and Auditing: Provides comprehensive audit logs and scheduled access certifications for privileged roles.
This Answer Would Be Correct If
The scenario required time-bound, just-in-time administrative role activation with mandatory approval workflows to protect sensitive administrative privileges in Azure and Microsoft Entra ID.
Microsoft Entra ID
Microsoft Entra ID
What Microsoft Entra ID Is
Microsoft Entra ID (formerly known as Azure Active Directory) is Microsoft's multi-tenant, cloud-based identity and access management (IAM) service. It serves as the primary identity foundation for securing, authenticating, and authorizing users, devices, and applications across cloud and hybrid environments.
How It Meets the Requirements
- Single Sign-On (SSO): Microsoft Entra ID allows users to sign in once with a single set of organizational credentials and securely access cloud services like Microsoft 365, the Azure portal, and thousands of integrated Software as a Service (SaaS) applications.
- Directory Synchronization: Through hybrid identity solutions like Microsoft Entra Connect and Microsoft Entra Cloud Sync, Microsoft Entra ID synchronizes user accounts, security groups, and password hashes from on-premises Active Directory Domain Services (AD DS) directly to the cloud.
Key Capabilities
- Centralized Identity Management: Manages the complete lifecycle of users, groups, and administrative roles.
- Modern Authentication Support: Provides native support for industry-standard protocols including SAML 2.0, OpenID Connect, and OAuth 2.0.
- Strong Security Controls: Supports built-in security mechanisms such as Multifactor Authentication (MFA) and Conditional Access policies.
- Seamless Hybrid Integration: Enables users to leverage identical credentials across both cloud-hosted and on-premises resources.
Why This Is Optimal
Microsoft Entra ID is the central cloud directory service designed specifically to eliminate identity silos, reduce password fatigue through SSO, and unify hybrid identity management across on-premises and multi-cloud ecosystems.
Microsoft Entra External ID
Microsoft Entra External ID
What Microsoft Entra External ID Is
Microsoft Entra External ID encompasses customer identity and access management (CIAM) and business-to-business (B2B) collaboration capabilities. It allows organizations to securely share applications with external partners, guests, and consumers.
Why It Doesn't Meet the Requirement
Microsoft Entra External ID is tailored for external user collaboration and consumer-facing application sign-ins (such as social login or one-time passcodes). It is not used for primary internal workforce directory synchronization or hybrid corporate identity management.
Key Characteristics and Limitations
- External Collaboration: Manages guest users and external partner invitations within an enterprise tenant.
- Consumer IAM: Enables end users to register and sign in to customer-facing applications using social identities (such as Google or Apple) or email accounts.
- Self-Service Portals: Provides customizable sign-up, sign-in, and profile management flows for external consumers.
This Answer Would Be Correct If
The organization needed to allow external customers and partners to sign in to a public-facing web application using social identities or personal email accounts.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Entra ID Protection
Describe directory services in Azure, including Microsoft Entra ID and Microsoft Entra Domain Services
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Entra Domain Services Managed Domain
Describe directory services in Azure, including Microsoft Entra ID and Microsoft Entra Domain Services
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Conditional Access
Describe directory services in Azure, including Microsoft Entra ID and Microsoft Entra Domain Services
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Entra Domain Services Legacy Authentication
Describe directory services in Azure, including Microsoft Entra ID and Microsoft Entra Domain Services
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Shared Responsibility Model
Describe the shared responsibility model
IntermediateAZ-400 Designing and Implementing Microsoft DevOps Solutions Exam
GitHub Branch Protection Rules and SAML SSO
Design and implement permissions and roles in GitHub
Last updated Validated