MS-102 Deploy and manage a Microsoft 365 tenant Practice Question
Your organization has a hybrid identity setup with Microsoft Entra Connect. You need to ensure that users can reset their passwords from the cloud and have the changes synchronized back to on-premises Active Directory. Which feature must you enable?
⚠ Common exam trap
Many exam-takers confuse password hash synchronization (which only syncs one-way) with password writeback (which enables cloud-to-on-premises password changes), leading them to select password hash synchronization as the answer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Password writeback.
Password writeback is the Microsoft Entra Connect feature that enables password changes performed in the cloud (e.g., via Microsoft Entra ID SSPR) to be written back to on-premises Active Directory. This ensures the on-premises password stays synchronized with the cloud, which is required for hybrid identity scenarios where users reset passwords from the cloud.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Password writeback.
Why this is correct
Password writeback is the only option that supports a bidirectional password flow: when a user performs a self-service password reset or changes their password in Microsoft Entra ID, Microsoft Entra Connect writes the new password back to the on-premises Active Directory. This requires Microsoft Entra ID Premium licensing and must be explicitly enabled in Microsoft Entra Connect, making it the correct feature for a hybrid identity organization that needs cloud-originated password changes reflected on-premises.
- ✗
Seamless single sign-on.
Why it's wrong here
Seamless single sign-on is an authentication method that silently signs users in when they are on domain-joined devices by presenting a Kerberos ticket, so they do not need to re-enter credentials. It does not include any password modification or writeback capability; it simply avoids prompting during sign-in. Therefore it cannot synchronize or return password changes from Microsoft Entra ID back to the on-premises directory.
- ✗
Pass-through authentication.
Why it's wrong here
Pass-through authentication validates a user's password by forwarding it from Microsoft Entra ID to the on-premises Active Directory for verification at sign-in time, but it never persists or propagates password changes. The validation is one-way: Microsoft Entra ID does not send updated passwords back to on-premises, and does not store the cloud password. Because the feature lacks any writeback mechanism, a cloud-initiated password reset would not affect the user's on-premises password.
- ✗
Password hash synchronization.
Why it's wrong here
Password hash synchronization copies a hash of the on-premises password to Microsoft Entra ID, enabling cloud authentication with the same password, but the flow is strictly one-way from on-premises to Microsoft Entra ID. If a user changes or resets a password in Microsoft Entra ID, that new password is not hashed and synchronized back to on-premises; password writeback is required for that reverse direction. Thus PHS alone cannot fulfill a requirement to propagate cloud password changes to the local Active Directory.
Visual reference
Go deeper
Related to this question
Learn chapter
Entra Connect Sync Rules and Filtering
Key term
Microsoft Entra Connect
Microsoft Entra Connect is a tool that synchronizes on-premises Active Directory identities with Microsoft Entra ID (formerly Azure AD) to enable single sign-on and centralized identity management.
Key term
Hybrid identity
Hybrid identity is an approach that synchronizes and manages user identities across both on-premises directories and cloud-based services, allowing seamless access to resources in both environments.
About these practice questions
One of 712 original MS-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.