The correct answer is Pass-Through Authentication (PTA) with Seamless SSO. This combination is chosen because PTA validates user passwords directly against on-premises Active Directory, ensuring that no password hashes are ever stored in Microsoft Entra ID, while Seamless SSO uses Kerberos delegation to provide automatic, silent sign-in for domain-joined devices. On the MS-102 exam, this scenario tests your ability to differentiate between authentication methods when the explicit requirement is to avoid cloud hash storage—a common trap is selecting Password Hash Synchronization (PHS) which does store hashes, or forgetting that Seamless SSO is a separate feature that must be enabled alongside PTA. Remember the key distinction: PTA is about where validation happens (on-prem), while Seamless SSO is about the user experience (no password prompt). Memory tip: “PTA keeps hashes at home, Seamless SSO keeps users logged in.”
MS-102 Practice Question: Implement and manage identity and access in Microsoft Entra ID
This MS-102 practice question tests your understanding of implement and manage identity and access in microsoft entra id. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company has an on-premises Active Directory environment and wants to sync user identities to Microsoft Entra ID while avoiding storing password hashes in the cloud. The company wants to provide seamless single sign-on (SSO) for domain-joined devices. Which authentication method should be chosen?
Why wrong: PHS synchronizes password hashes to Azure AD, which stores them in the cloud, contrary to the requirement.
B
Pass-Through Authentication (PTA) with Seamless SSO
PTA authenticates users on-premises and does not store password hashes in the cloud. Seamless SSO provides automatic sign-in for domain-joined devices.
C
Federation with Active Directory Federation Services (AD FS)
Why wrong: Federation requires an on-premises AD FS farm and does not necessarily avoid storing password hashes if PHS is also enabled; it adds complexity.
D
Cloud-only authentication
Why wrong: Cloud-only authentication does not sync from on-premises AD, which does not meet the requirement of syncing identities.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Pass-Through Authentication (PTA) with Seamless SSO
Pass-Through Authentication (PTA) with Seamless SSO is the correct choice because it validates user passwords directly against on-premises Active Directory without storing any password hashes in the cloud. Seamless SSO provides automatic sign-in for domain-joined devices using Kerberos delegation, meeting the requirement for a seamless SSO experience without password hash storage.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Password Hash Synchronization (PHS)
Why it's wrong here
PHS synchronizes password hashes to Azure AD, which stores them in the cloud, contrary to the requirement.
✓
Pass-Through Authentication (PTA) with Seamless SSO
Why this is correct
PTA authenticates users on-premises and does not store password hashes in the cloud. Seamless SSO provides automatic sign-in for domain-joined devices.
Related concept
Read the scenario before looking for a memorised answer.
✗
Federation with Active Directory Federation Services (AD FS)
Why it's wrong here
Federation requires an on-premises AD FS farm and does not necessarily avoid storing password hashes if PHS is also enabled; it adds complexity.
✗
Cloud-only authentication
Why it's wrong here
Cloud-only authentication does not sync from on-premises AD, which does not meet the requirement of syncing identities.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often choose Password Hash Synchronization (PHS) because it is simpler and supports Seamless SSO, but they overlook the explicit requirement to avoid storing password hashes in the cloud, which PHS inherently does.
Detailed technical explanation
How to think about this question
PTA uses an on-premises agent to validate passwords against Active Directory via the NetLogon service, and Seamless SSO leverages Kerberos ticket exchange (using the AZUREADSSOACC computer account) to silently authenticate users on domain-joined devices. A subtle behavior is that PTA requires outbound connectivity from the agent to Microsoft Entra ID on ports 80 and 443, and it does not support smart card or certificate-based authentication natively, which can be a limitation in some enterprise scenarios.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this MS-102 question in full detail.
Implement and manage identity and access in Microsoft Entra ID — This question tests Implement and manage identity and access in Microsoft Entra ID — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Pass-Through Authentication (PTA) with Seamless SSO — Pass-Through Authentication (PTA) with Seamless SSO is the correct choice because it validates user passwords directly against on-premises Active Directory without storing any password hashes in the cloud. Seamless SSO provides automatic sign-in for domain-joined devices using Kerberos delegation, meeting the requirement for a seamless SSO experience without password hash storage.
What should I do if I get this MS-102 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.