Match each Azure identity service to its description.
Drag a concept onto its matching description — or click a concept then click the description.
Cloud-based identity and access management
Customer identity and access management
Managed domain services like Group Policy
Automatically managed identity for Azure resources
Sync on-premises directories to Azure AD
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Microsoft Entra ID: Cloud-based identity and access management service for employees and internal users.
Correct matches: Microsoft Entra ID for internal users, Azure AD B2C for customers, Managed Identities for Azure resources. Common confusions include swapping B2C with domain services or managed identities.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Microsoft Entra ID: Cloud-based identity and access management service for employees and internal users.
Why this is correct
Microsoft Entra ID (formerly Azure AD) is a multi-tenant cloud identity provider designed for organizational identities, handling enterprise-level authentication and authorization. It supports single sign-on, multi-factor authentication, and conditional access policies, and it acts as the identity plane that controls access to Azure subscriptions, Microsoft 365, and thousands of enterprise SaaS applications. Because it is built for employees and internal users, its directory and security defaults are optimized for workplace scenarios, not external consumers.
Azure AD B2C: Identity service for managing customer identities with customizable sign-up and sign-in.
Why this is correct
Azure AD B2C (Business-to-Consumer) is a customer identity access management (CIAM) service that external organizations use to authenticate consumers in their own applications. It lets developers customize sign-up and sign-in pages, invite social identity providers such as Google or Facebook, and store customer directory records separately from an organization's employee directory. Unlike Microsoft Entra ID, B2C is not used for internal corporate access but for customer-facing branded authentication flows.
Managed Identities: Automatically managed service principals allowing apps to authenticate to Azure resources.
Why this is correct
With Managed Identities, Azure automatically creates a service principal in Microsoft Entra ID on behalf of an Azure resource, such as a VM, App Service, or Function App. The application can obtain tokens from the Azure Instance Metadata Service (IMDS) endpoint without storing, rotating, or embedding any secret in code or configuration. This makes managed identities the safest way for Azure workloads to authenticate to Azure SQL Database, Key Vault, Storage, or other Azure services, because the identity lifecycle is fully handled by the platform.
Azure AD B2C: Provides managed domain services like domain join and group policy.
Why it's wrong here
This statement incorrectly describes Azure AD Domain Services (now Microsoft Entra Domain Services), not Azure AD B2C. Domain join, Group Policy, LDAP, and Kerberos/NTLM authentication are managed domain features provided by Domain Services to lift-and-shift legacy applications to Azure without deploying domain controllers. Azure AD B2C, by contrast, is only for external customer identities and sign-in experiences; it does not manage Windows Server domains or policy objects.
Managed Identities: Identity service for managing customer identities and sign-up/sign-in.
Why it's wrong here
Managed Identities are workload identities, not consumer identity services. They exist solely to let an Azure resource authenticate to another Azure resource; they do not support interactive sign-in, user registration, customizable web experiences, or consumer identity storage. Customer sign-up/sign-in capabilities are the domain of Azure AD B2C, so matching managed identities to that description confuses a non-interactive authentication mechanism with a customer identity access management product.
Go deeper
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.