MS-102 Practice Question: Implement and manage Microsoft Entra identity and access
You are implementing Microsoft Entra Verified ID. Which technology does it use to create decentralized digital identities?
⚠ Common exam trap
Test-takers frequently confuse authentication/authorization protocols (OpenID Connect, OAuth 2.0, SAML) with the underlying decentralized identity infrastructure (DIDs), mistakenly thinking these protocols are used to create the identity itself rather than to secure access to it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Decentralized Identifiers (DIDs)
Microsoft Entra Verified ID uses Decentralized Identifiers (DIDs) as the core technology to create decentralized digital identities. DIDs are globally unique identifiers that are cryptographically verifiable and do not rely on a centralized registry, enabling self-sovereign identity scenarios where users control their own identity data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Decentralized Identifiers (DIDs)
Why this is correct
Decentralized Identifiers (DIDs) are the foundation of Microsoft Entra Verified ID. They are a W3C standard for globally unique identifiers that are cryptographically verifiable and do not require a central registration authority. DIDs enable the issuer, holder, and verifier to interact via verifiable credentials, with the DID document containing public keys and service endpoints used to establish trust. The core is that DIDs provide a decentralized, self-sovereign identity layer, not merely an authentication protocol.
- ✗
OpenID Connect
Why it's wrong here
OpenID Connect (OIDC) is an authentication protocol built on OAuth 2.0 that enables a client to verify a user's identity via an ID token. It is widely used for single sign-on and depends on a centralized identity provider (IdP) to issue tokens, which means the IdP controls the identity lifecycle. In Verified ID, OIDC can be used for authentication in presentation flows, but it is not the decentralized identity technology; that role belongs to DIDs and verifiable credentials, which remove the need for a central authority.
- ✗
OAuth 2.0
Why it's wrong here
OAuth 2.0 is an authorization framework that allows an application to obtain limited access to a user's resources using access tokens, but it does not define any mechanism for decentralized identifiers or credentials. Its trust model is based on centralized authorization servers, registered scopes, and resource owners, which conflicts with the decentralized, self-sovereign model of Verified ID. Although OAuth tokens may appear in verification flows, OAuth is about delegated permission, not identity, making it categorically different from DIDs.
- ✗
Security Assertion Markup Language (SAML)
Why it's wrong here
SAML is a federated identity standard that exchanges XML-based assertions for authentication and authorization between parties, typically through a centralized identity provider. It enables single sign-on across domains but relies on pre-established trust relationships that are often centrally managed, and its assertions are not cryptographically tied to a decentralized identifier. The trust model is not designed for verifiable credentials, so SAML cannot provide the decentralized verification that Microsoft Entra Verified ID requires; instead, EC (or DIDs) serve that purpose.
Go deeper
Related to this question
About these practice questions
This MS-102 question is part of Courseiva's 712-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on MS-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are implementing Microsoft Entra Verified ID to issue verifiable credentials to employees for proof of employment. Which component is required to issue and verify credentials?
easy- A.Microsoft Entra ID P2 licenses for all users
- B.A certificate from a public certificate authority (CA)
- C.An Azure AD B2C tenant
- ✓ D.A decentralized identifier (DID) and a trusted identity system
Why D: Microsoft Entra Verified ID uses a decentralized identity model where each issuer and verifier has a unique decentralized identifier (DID) and a trusted identity system (such as a blockchain-based ION network or a web-based DID method) to publish and resolve DID documents. The DID and the trusted identity system are the core components required to cryptographically sign verifiable credentials and verify them without relying on a central authority, making option D correct.
Variation 2. An organization is implementing Microsoft Entra Verified ID for verifiable credentials. They want to issue credentials to employees that can be used to prove employment status to third parties. Which component must be created first?
medium- A.A presentation request policy
- B.A distributed ledger network
- ✓ C.A credential manifest in the Microsoft Entra admin center
- D.A decentralized identifier (DID) for the organization
Why C: The credential manifest defines the rules for issuing a verifiable credential, including the claims schema, display information, and issuance policies. In Microsoft Entra Verified ID, you must create the credential manifest in the Entra admin center before any credentials can be issued, as it serves as the template that governs the credential's structure and validation. Without a manifest, there is no definition for what the credential contains or how it should be presented.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.