MS-102 Practice Question: A company uses Microsoft Entra Connect with…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Create a computer account named AZUREADSSOACC in each AD forest

  Why this is correct

  Seamless SSO requires a dedicated computer account named AZUREADSSOACC to be created in each Active Directory forest that is synchronized to Microsoft Entra ID. This account is registered with Microsoft Entra Connect during feature enablement, and its Kerberos decryption key is used to validate user sign-in requests without prompting for passwords. Without this account, the silent authentication flow cannot complete, so it is the essential prerequisite for Seamless SSO with password hash sync.

• ✗

  Install Microsoft Entra Connect on a separate server

  Why it's wrong here

  Microsoft Entra Connect is already deployed in the environment, and Seamless SSO is configured directly within the existing Microsoft Entra Connect instance by running the 'Configure Seamless SSO' wizard. Installing Microsoft Entra Connect on a separate server would introduce redundancy or a second synchronization engine, which is not supported for the same tenant, and it does not affect the authentication method already in use. Reinstalling or moving to another server is both unnecessary and potentially disruptive to directory sync.

• ✗

  Enable Passthrough Authentication

  Why it's wrong here

  Passthrough Authentication (PTA) is an entirely different authentication mechanism that validates user passwords against on-premises Active Directory in real time, rather than using password hashes synchronized to Microsoft Entra ID. Seamless SSO is an optional feature that works alongside either authentication method to provide silent sign-in, but enabling PTA does not create the AZUREADSSOACC computer account nor does it implement the Kerberos-based silent flow. Therefore, PTA is not a substitute for Seamless SSO and would be an incorrect action for the stated requirement.

• ✗

  Set the service connection point in Active Directory

  Why it's wrong here

  A service connection point (SCP) in Active Directory is used in scenarios such as Microsoft Entra Domain Services domain discovery or when configuring federation with Active Directory Federation Services (AD FS), but it is not involved in Seamless SSO. Seamless SSO relies on the AZUREADSSOACC computer account and the Kerberos protocol to obtain a token for the user, not on an SCP. Setting an SCP would have no effect on the silent sign-in flow and is therefore irrelevant for enabling Seamless SSO.

Go deeper

Related to this question