A technician is configuring a new Windows 10 workstation for a user who travels frequently. The user needs to be able to log in without an internet connection. The workstation is joined to Azure AD. Which sign-in option should the technician configure to provide offline access?

Passwordless sign-in with Microsoft Authenticator

Microsoft Authenticator passwordless sign-in requires the phone to receive a push notification, which needs an internet connection. It does not work offline.

Picture Password

Picture Password is a Windows 8/10 feature that allows sign-in by drawing gestures on a picture. It works offline but is less secure and not typically recommended for corporate devices. It is also not the standard for Azure AD.

Physical Security Key (FIDO2)

While some FIDO2 security keys support offline authentication, the initial setup and credential caching may still require internet. The PIN is simpler and more universally supported for offline sign-in on Azure AD joined devices.

What does this 220-1102 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Windows Hello PIN — Windows Hello PIN is stored locally on the device using a Trusted Platform Module (TPM) and allows the user to sign in even when the device is not connected to the internet. Passwordless sign-in with Microsoft Authenticator requires an internet connection to push a notification to the phone. Picture Password is also local but less secure and not recommended for enterprise use. A physical security key requires the hardware key but still authenticates against the cloud; some keys support offline authentication via FIDO2, but this is not as straightforward as a PIN. For Azure AD joined devices, the PIN is the standard offline credential.

What should I do if I get this 220-1102 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.