Passwordless Authentication Strategy for Hybrid Identity
Your organization, Fabrikam Inc., uses Microsoft Entra ID with a hybrid identity configuration. You have 500 cloud-only users and 5,000 synced users from on-premises Active Directory. The company wants to implement a passwordless authentication strategy. The following requirements must be met: 1) All users must be able to sign in without a password on Windows 10/11 devices that are Microsoft Entra joined. 2) Users who are not assigned a mobile phone must be able to use a security key (FIDO2). 3) The solution must work for both cloud-only and synced users. 4) The passwordless method should require the lowest administrative overhead for enrollment. Which passwordless authentication method should you recommend?
Quick Answer
The answer is Windows Hello for Business. This is the correct passwordless authentication method for hybrid users because it operates directly on Microsoft Entra joined Windows 10/11 devices, supporting both cloud-only and synced users without requiring additional hardware like security keys or mobile phones. For Fabrikam’s environment, Windows Hello for Business meets all requirements: it works on joined devices, eliminates the need for mobile devices for users without phones, and supports both identity types, while its built-in biometric or PIN enrollment offers the lowest administrative overhead compared to distributing FIDO2 keys or managing a PKI for certificate-based authentication. On the MS-102 exam, this scenario tests your ability to match passwordless methods to hybrid identity constraints—common traps include choosing FIDO2 for its hardware independence or Microsoft Authenticator for its ubiquity, but remember that Windows Hello for Business is the only option that combines device-bound authentication with zero enrollment infrastructure for hybrid users. Memory tip: “Hello works on joined hardware, no keys or phones required.”
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
FIDO2 security keys
FIDO2 security keys (option C) meet all requirements: they work on Microsoft Entra joined Windows 10/11 devices without a password, support both cloud-only and synced users, and provide a security key option for users without mobile phones as required. Enrollment is simple (plug in and register via Windows Settings) with low administrative overhead (can be pre-provisioned or self-enrolled). Option D (Windows Hello for Business) is incorrect because it uses PIN or biometric on the device, not a separate security key, so it fails requirement 2. Option A (certificate-based authentication) requires PKI infrastructure and certificate enrollment, increasing administrative overhead. Option B (Microsoft Authenticator app) requires a mobile phone, which conflicts with requirement 2.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Certificate-based authentication
Why it's wrong here
Certificate-based authentication requires a PKI infrastructure and certificate enrollment, which increases administrative overhead. It does not meet the requirement for lowest administrative overhead.
- ✗
Microsoft Authenticator app
Why it's wrong here
Microsoft Authenticator app requires a mobile phone, which conflicts with requirement 2 (users without mobile phones must use a security key). It is not suitable for all users.
- ✓
FIDO2 security keys
Why this is correct
FIDO2 security keys satisfy all requirements: passwordless sign-in on Microsoft Entra joined Windows 10/11 devices, support for both cloud-only and synced users, security key option for users without mobile phones, and low enrollment overhead (plug and play with simple registration).
- ✗
Windows Hello for Business
Why it's wrong here
Windows Hello for Business uses a PIN or biometric on the device, not a separate security key. It does not fulfill requirement 2 (users without mobile phones must use a security key).
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
Hybrid identity
Hybrid identity is an approach that synchronizes and manages user identities across both on-premises directories and cloud-based services, allowing seamless access to resources in both environments.
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
About these practice questions
This MS-102 question is part of Courseiva's 241-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MS-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Microsoft Entra ID for identity management. You need to ensure that users can access internal applications using single sign-on (SSO) without storing passwords in the cloud. Which authentication method should you implement?
easy- A.Federation with AD FS
- ✓ B.Windows Hello for Business
- C.Password hash synchronization
- D.Pass-through authentication
Why B: Windows Hello for Business is correct because it enables passwordless single sign-on (SSO) to internal applications using biometric or PIN credentials, with the private key stored on the user's device rather than in the cloud. This meets the requirement of no passwords stored in the cloud while still providing seamless SSO access.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.