easyMultiple Choice
MD-102 Practice Question: Implementing Windows Hello for Business and wants…
A company is implementing Windows Hello for Business and wants to use certificate-based authentication. They have an on-premises Active Directory and are using Microsoft Entra Connect for hybrid identity. Which prerequisites must be met to support certificate-based Windows Hello for Business?
⚠ Common exam trap
A common mix-up: candidates confuse the prerequisites for certificate-based Windows Hello for Business with those for passwordless sign-in or MFA, mistakenly thinking that the Authenticator app or Conditional Access policies are required, when in fact the core requirement is an enterprise CA and the correct device join state.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An enterprise certification authority (CA) must be deployed and all devices must be Microsoft Entra ID joined or hybrid Microsoft Entra ID joined.
Certificate-based Windows Hello for Business requires an enterprise PKI to issue and validate certificates for authentication. Devices must be Microsoft Entra ID joined or hybrid Microsoft Entra ID joined to enroll these certificates and support the certificate trust model. On-premises Active Directory and Microsoft Entra Connect provide the hybrid identity foundation, but the CA and appropriate device join state are the critical prerequisites.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
All users must have the Microsoft Authenticator app installed.
Why it's wrong here
Microsoft Authenticator supports phone sign-in and MFA, but certificate-based Windows Hello for Business relies on a certificate authority and a certificate registration authority, not an authenticator app. Authenticator is relevant for passwordless phone sign-in scenarios, not this certificate trust model.
- ✗
Conditional Access policies must be configured to require Windows Hello for Business.
Why it's wrong here
Conditional Access governs access decisions after authentication; it does not issue the certificate that Windows Hello for Business requires. Requiring Windows Hello through Conditional Access is valid for enforcing MFA or device compliance, not for establishing certificate-based authentication prerequisites.
- ✓
An enterprise certification authority (CA) must be deployed and all devices must be Microsoft Entra ID joined or hybrid Microsoft Entra ID joined.
Why this is correct
Certificate-based Windows Hello for Business requires an enterprise CA to issue the authentication certificates, and devices must be Microsoft Entra joined or hybrid joined so they can enrol and obtain those certificates. Both conditions are prerequisites for the certificate trust deployment model.
- ✗
All users must be configured for passwordless sign-in.
Why it's wrong here
Passwordless sign-in is an outcome of deploying Windows Hello for Business, not a prerequisite for certificate-based authentication. Configuring passwordless options is correct when rolling out phone sign-in or security key methods, but it does not supply the certificate infrastructure this deployment needs.
Go deeper
Related to this question
Learn chapter
Implementing BitLocker and Device Encryption
Key term
Hybrid identity
Hybrid identity is an approach that synchronizes and manages user identities across both on-premises directories and cloud-based services, allowing seamless access to resources in both environments.
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
About these practice questions
Courseiva writes every MD-102 question from scratch — 556 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.