AZ-500 Secure identity and access Practice Question
You are troubleshooting why a user cannot sign in to a custom line-of-business application that is federated with Microsoft Entra ID. The user reports that they are repeatedly prompted for credentials and then receive an error. The application is configured for SAML-based SSO. What is the most likely cause?
⚠ Common exam trap
Candidates often confuse a SAML certificate expiration/mismatch with a licensing issue or browser configuration problem, but the repeated credential prompt followed by an error is the hallmark of a failed SAML assertion validation, not a missing license or disabled cookies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The SAML certificate has expired or the configuration has a mismatch
When a SAML-based SSO application repeatedly prompts for credentials and then fails, the most common cause is an expired or misconfigured SAML signing certificate. The certificate is used by Microsoft Entra ID to sign SAML assertions; if it has expired, or if the thumbprint, audience URI, or reply URL in the Entra ID configuration does not match what the application expects, the application will reject the assertion and force re-authentication or display an error.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The user's browser cookies are disabled
Why it's wrong here
SAML SSO relies on the browser to relay messages and maintain the authentication session via cookies after redirects, so disabled cookies can interrupt the sign-in flow. However, if the certificate or metadata is invalid, the application will not accept the SAML assertion regardless of cookie state. This is a client-side condition, not the primary cause of a certificate validation or configuration error.
- ✗
The application is not registered in the app gallery
Why it's wrong here
Being absent from the Microsoft Entra ID application gallery has no bearing on sign-in, because you can register an application as a custom or non-gallery enterprise app and manually configure SAML endpoints and certificates. The gallery simply provides pre-built templates to simplify configuration. The app could still be fully functional without being listed.
- ✓
The SAML certificate has expired or the configuration has a mismatch
Why this is correct
SAML certificates are used to sign the SAML response; the service provider uses the certificate's public key to validate the signature. If the certificate has expired or the configured certificate doesn't match the one trusted by the application, the SP will discard the assertion and deny sign-in. Likewise, a mismatch in the SAML configuration (e.g., Entity ID, Reply URL, or signing algorithm) will cause authentication failures even when the certificate is valid.
- ✗
The user does not have a license for Microsoft Entra ID
Why it's wrong here
Microsoft Entra ID Free tier supports SAML-based SSO for enterprise applications, so a user does not require a Premium license to sign in. The user merely needs an active directory account that is assigned to the application. If the user lacks any Entra ID license, they may not have an identity at all, but that is different from not holding a paid license; the free tier covers this scenario.
Go deeper
Related to this question
About these practice questions
One of 617 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.