mediumMultiple ChoiceObjective-mapped
MS-102 Practice Question: A company uses Azure AD Connect with password…
A company uses Azure AD Connect with password hash synchronization. They want to enable Azure AD Seamless Single Sign-On (SSO) for users accessing Microsoft 365 from domain-joined devices on the corporate network. Which configuration is required on the on-premises Active Directory?
⚠ Common exam trap
Test-takers frequently confuse Seamless SSO with Passthrough Authentication or think a separate server is required, but the key requirement is the specific computer account AZUREADSSOACC in each forest, which is a unique Kerberos-based mechanism.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a computer account named AZUREADSSOACC in each AD forest
Azure AD Seamless SSO requires a computer account named AZUREADSSOACC to be created in each on-premises AD forest. This account is used by Azure AD to sign Kerberos tickets for users accessing Microsoft 365 resources, enabling automatic sign-in without password prompts. The account must be created in the root domain of each forest and its password is managed automatically by Azure AD Connect.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a computer account named AZUREADSSOACC in each AD forest
Why this is correct
Seamless SSO requires a dedicated computer account named AZUREADSSOACC to be created in each Active Directory forest that is synchronized to Azure AD. This account is registered with Azure AD Connect during feature enablement, and its Kerberos decryption key is used to validate user sign-in requests without prompting for passwords. Without this account, the silent authentication flow cannot complete, so it is the essential prerequisite for Seamless SSO with password hash sync.
- ✗
Install Azure AD Connect on a separate server
Why it's wrong here
Azure AD Connect is already deployed in the environment, and Seamless SSO is configured directly within the existing Azure AD Connect instance by running the 'Configure Seamless SSO' wizard. Installing Azure AD Connect on a separate server would introduce redundancy or a second synchronization engine, which is not supported for the same tenant, and it does not affect the authentication method already in use. Reinstalling or moving to another server is both unnecessary and potentially disruptive to directory sync.
- ✗
Enable Passthrough Authentication
Why it's wrong here
Passthrough Authentication (PTA) is an entirely different authentication mechanism that validates user passwords against on-premises Active Directory in real time, rather than using password hashes synchronized to Azure AD. Seamless SSO is an optional feature that works alongside either authentication method to provide silent sign-in, but enabling PTA does not create the AZUREADSSOACC computer account nor does it implement the Kerberos-based silent flow. Therefore, PTA is not a substitute for Seamless SSO and would be an incorrect action for the stated requirement.
- ✗
Set the service connection point in Active Directory
Why it's wrong here
A service connection point (SCP) in Active Directory is used in scenarios such as Azure AD Domain Services domain discovery or when configuring federation with Active Directory Federation Services (AD FS), but it is not involved in Seamless SSO. Seamless SSO relies on the AZUREADSSOACC computer account and the Kerberos protocol to obtain a token for the user, not on an SCP. Setting an SCP would have no effect on the silent sign-in flow and is therefore irrelevant for enabling Seamless SSO.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
SSO
Single Sign-On (SSO) is an authentication process that allows a user to access multiple applications or systems with one set of login credentials.
Key term
Password hash synchronization
Password hash synchronization is a Microsoft Azure AD Connect feature that synchronizes a hash of a user's on-premises Active Directory password to Azure AD, enabling cloud-based authentication without additional infrastructure.
About these practice questions
This MS-102 question is part of Courseiva's 241-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.