DP-900 Describe an analytics workload on Azure Practice Question
A company uses Azure Databricks for data engineering. They need to ensure that only authorized users can access the workspace, and they want to use single sign-on (SSO) with their existing identity provider. Which integration should they configure?
⚠ Common exam trap
Many candidates confuse Azure Key Vault (a secrets store) with identity management, or assume Microsoft Defender XDR or Intune handle SSO, when only Microsoft Entra ID provides the federation and authentication services required for single sign-on.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID (Azure AD)
Microsoft Entra ID (Azure AD) is the identity and access management service that provides SSO capabilities for Azure Databricks. By integrating Azure Databricks with Entra ID, you can enforce conditional access policies and authenticate users via your existing identity provider using protocols like SAML 2.0 or OAuth 2.0, ensuring only authorized users access the workspace.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Defender XDR
Why it's wrong here
Microsoft Defender XDR is a unified security operations suite that aggregates signals from Microsoft 365 Defender components to detect, investigate, and respond to threats. It does not act as an identity provider or issue authentication tokens, so it cannot implement single sign-on for Azure Databricks. Security tooling such as Defender XDR relies on Microsoft Entra ID for identity, but it does not replace it.
- ✗
Microsoft Intune
Why it's wrong here
Microsoft Intune is a cloud-based endpoint management service for managing devices, apps, and compliance policies, including mobile device management (MDM) and mobile application management (MAM). Although Intune can apply conditional access policies in conjunction with Microsoft Entra ID to control access to apps like Azure Databricks, it does not authenticate users or provide an SSO identity layer. Intune manages the devices and access policies, not the user identities themselves.
- ✗
Azure Key Vault
Why it's wrong here
Azure Key Vault is a secrets management service that safely stores cryptographic keys, certificates, and secrets such as connection strings or service principal credentials. These secrets can be referenced by Azure Databricks via secret scopes to access other data stores, but Key Vault does not authenticate end users or participate in the SSO token flow. Storing a service principal password in Key Vault is not the same as providing identity services; authentication still relies on Microsoft Entra ID.
- ✓
Microsoft Entra ID (Azure AD)
Why this is correct
Microsoft Entra ID (formerly Azure Active Directory) is the correct answer because it is the cloud identity and access management service that authenticates users and issues security tokens for Azure Databricks. Azure Databricks integrates natively with Entra ID through OAuth 2.0 and OpenID Connect, enabling single sign-on, conditional access, and MFA for the data engineering platform. Entra ID also supports SCIM-based user provisioning to keep Databricks workspaces synchronized with standard enterprise identities.
Go deeper
Related to this question
Learn chapter
Data Roles and Core Concepts
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
Key term
Data
Data is raw, unprocessed information, like numbers, words, or measurements, that can be stored, processed, and analyzed by computers.
About these practice questions
One of 820 original DP-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-900 exam.