Match each Azure identity service to its description.
Drag a concept onto its matching description — or click a concept then click the description.
Cloud-based identity and access management
Customer identity and access management for apps
Managed domain services like LDAP and Kerberos
Role-based access control for Azure resources
Policy-based evaluation to enforce access controls
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Microsoft Entra ID: Cloud-based identity and access management service for Microsoft cloud resources.
Microsoft Entra ID is the core identity service for Microsoft cloud. Microsoft Entra B2B enables external collaboration, Azure AD B2C serves customer-facing apps, and Microsoft Entra Domain Services provides domain services for VMs. Common confusions include swapping B2C with Microsoft Entra ID or B2B with AD DS.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Microsoft Entra ID: Cloud-based identity and access management service for Microsoft cloud resources.
Why this is correct
Microsoft Entra ID is Microsoft's cloud-based identity and access management (IAM) service, acting as the authoritative directory for employee, partner, and even external guest identities used to access Microsoft cloud resources like Microsoft 365, Azure, and thousands of SaaS applications. It provides essential capabilities including single sign-on to enterprise applications, multi-factor authentication, conditional access policies, and device management enforcement. Rather than supporting unauthenticated consumer sign-up flows, it is optimized for governed organizational access, although it can issue tokens for applications using modern OAuth 2.0 and OIDC protocols.
Microsoft Entra B2B: Allows collaboration with external partners using their own identities.
Why this is correct
Microsoft Entra B2B (business-to-business) is designed for secure external collaboration, allowing you to share your organization's apps and resources with partners, suppliers, or other businesses while they authenticate with their own corporate or social identity credentials. These guest users are represented in your Microsoft Entra ID tenant as user objects but do not require a new password or separate account, and you can control access through conditional access and review their access lifecycle. This approach eliminates the need to replicate identities locally, while keeping relationships and permissions centralized.
Azure AD B2C: Identity service for customer-facing applications with customizable sign-up and sign-in.
Why this is correct
Azure AD B2C (business-to-consumer) is a customer identity and access management (CIAM) service tailored for consumer-facing applications, where users sign up and sign in using local accounts or social identity providers like Facebook, Google, or Microsoft. It enables highly customizable journeys via user flows or custom policies, complete with branding, self-service password reset, and multi-factor authentication, all isolated from the organization's employee directory. It is a separate service from Microsoft Entra ID, intended for identities that are not members of your tenant.
Microsoft Entra Domain Services: Provides domain services such as group policy and authentication for Azure VMs without domain controllers.
Why this is correct
Microsoft Entra Domain Services provides managed domain services such as domain join, group policy, LDAP, Kerberos/NTLM authentication, and DNS resolution for Azure resources, without requiring you to deploy and patch your own domain controllers. It automatically synchronizes user accounts and group memberships from your Microsoft Entra ID tenant (or an on-premises AD DS environment via Microsoft Entra Connect) into its managed directory, letting legacy applications that rely on on-premises AD functionality operate natively in the cloud. This makes it ideal for lifting and shifting Windows Server workloads that cannot authenticate directly against Microsoft Entra ID's modern endpoints.
Microsoft Entra ID: Identity service for customer-facing applications with customizable sign-up and sign-in.
Why it's wrong here
The described capability is that of Azure AD B2C, not Microsoft Entra ID itself. Microsoft Entra ID serves as an enterprise identity provider for organizational identities, governing access to Microsoft cloud services and custom business applications through policies such as tenant-wide conditional access. It does not provide customizable, customer-facing sign-up and sign-in flows; those flows belong to B2C, which is a separate service for consumer-facing apps. Therefore this option is incorrect because it conflates Microsoft Entra ID's organizational focus with B2C's customer identity management focus.
Microsoft Entra B2B: Provides domain services for Azure VMs.
Why it's wrong here
This description belongs to Microsoft Entra Domain Services, not to Microsoft Entra B2B. Microsoft Entra B2B is exclusively concerned with bringing external users into your organization for collaboration, allowing them to leverage their own identities to access internal apps and resources. It does not manage domain joins, group policy, or Kerberos/NTLM authentication, which are the hallmarks of Microsoft Entra Domain Services. Labeling domain services as B2B is incorrect because B2B addresses trust and externality, not the legacy directory protocols required by domain-joined workloads.
Go deeper
About these practice questions
One of 795 original AZ-305 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.