AZ-900 Describe Azure architecture and services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Azure Active Directory

  Why it's wrong here

  Azure Active Directory is an identity and access management service for organizational identities, such as employees, partners, and guests within a single enterprise tenant. It is optimized for scenarios like single sign-on to Microsoft 365 or line-of-business apps, and it uses Conditional Access and group membership to govern access. For an internet-facing consumer application, standard Azure AD would require guest accounts and does not natively support arbitrary social identity providers in a self-service sign-up flow. Azure AD B2C, on the other hand, is the dedicated service for that exact external-identity use case.

• ✓

  Azure Active Directory B2C

  Why this is correct

  Azure Active Directory B2C is a customer identity access management (CIAM) service designed specifically for external, consumer-facing applications. It supports identity federation with social providers like Facebook and Google, as well as enterprise providers via SAML/OpenID Connect, while also allowing local accounts with email/password. AD B2C provides customizable user journeys, including sign-up, sign-in, password reset, and profile editing, all controlled by a policy engine. This makes it the correct choice for a public application that needs to bring its own customer identity store and social login options.

• ✗

  Azure Key Vault

  Why it's wrong here

  Azure Key Vault is a cloud service for securely storing and managing sensitive information such as API keys, encryption keys, certificates, and secrets. It provides cryptographic operations and access control via policies, but it does not implement any authentication protocols like OAuth2 or OpenID Connect. In the context of a consumer application, Key Vault might hold a client secret for an API call, but it cannot authenticate users, accept social logins, or generate identity tokens. Thus, it is a security management service, not an identity platform.

• ✗

  Azure Multi-Factor Authentication

  Why it's wrong here

  Azure Multi-Factor Authentication is a security feature that adds an additional verification step, such as a phone call or app notification, to an existing authentication flow. It does not itself authenticate users or manage identity directories; it only enforces a second factor after a user has presented a primary credential. In a consumer-facing app, you first need an identity provider like Azure AD B2C to handle social or local authentication, and only then could MFA be layered on top. Therefore, MFA is an accessory, not the required identity platform.

Go deeper

Related to this question