The answer is domain join and Azure AD Connect with device writeback enabled. These two components are required for a Hybrid Azure AD join because on-premises domain join establishes the device’s identity in Active Directory, while device writeback allows Azure AD Connect to synchronize that device object back to Azure AD, enabling seamless single sign-on and conditional access policies. On the Microsoft 365 Endpoint Administrator MD-102 exam, this concept tests your understanding of the hybrid identity bridge—a common trap is assuming that simply syncing users is enough, but without device writeback, the device object never registers in Azure AD. A reliable memory tip is “Join first, writeback second”: the device must be domain-joined before Azure AD Connect can write the object back. This pairing ensures that on-premises and cloud identities align for hybrid scenarios, a frequent focus in exam questions about device registration and compliance.
MD-102 Manage identity and compliance Practice Question
This MD-102 practice question tests your understanding of manage identity and compliance. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Which TWO of the following are required to implement Azure AD Join for Windows 10 devices in a hybrid environment with on-premises Active Directory?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Windows 10 devices that are domain-joined to the on-premises Active Directory.
Option B is correct because Azure AD Join in a hybrid environment requires devices to be domain-joined to on-premises Active Directory first. This allows Azure AD Connect to synchronize the device objects and, with device writeback enabled, register them in Azure AD, enabling seamless single sign-on and conditional access.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Active Directory Federation Services (AD FS) deployed.
Why it's wrong here
Federation is not required; password hash sync is sufficient.
✓
Windows 10 devices that are domain-joined to the on-premises Active Directory.
Why this is correct
Devices must be domain-joined to be hybrid Azure AD joined.
Related concept
Read the scenario before looking for a memorised answer.
✓
Azure AD Connect with device writeback enabled.
Why this is correct
Device writeback is required for hybrid Azure AD join.
Related concept
Read the scenario before looking for a memorised answer.
✗
Azure AD Premium P1 licenses for all users.
Why it's wrong here
Azure AD Premium P1 is not a requirement for Azure AD Join; it provides additional features.
✗
Windows Hello for Business configured for all users.
Why it's wrong here
Windows Hello for Business is optional.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often assume AD FS is mandatory for any hybrid identity scenario, but Microsoft supports multiple authentication methods (e.g., PHS, PTA) that do not require AD FS for Azure AD Join.
Detailed technical explanation
How to think about this question
Under the hood, Azure AD Connect uses the device synchronization engine to write back device objects from on-premises AD to Azure AD, leveraging the msDs-DeviceContainer and device registration service. The domain-joined device then authenticates via Kerberos or NTLM to Azure AD, and the join process creates a device object in Azure AD with a unique device ID. In real-world scenarios, failing to enable device writeback results in devices not appearing in Azure AD, breaking hybrid join and conditional access policies.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this MD-102 question in full detail.
Manage identity and compliance — This question tests Manage identity and compliance — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Windows 10 devices that are domain-joined to the on-premises Active Directory. — Option B is correct because Azure AD Join in a hybrid environment requires devices to be domain-joined to on-premises Active Directory first. This allows Azure AD Connect to synchronize the device objects and, with device writeback enabled, register them in Azure AD, enabling seamless single sign-on and conditional access.
What should I do if I get this MD-102 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.