Entra Application Proxy for Passwordless On-Premises Apps
Your organization is designing a hybrid identity infrastructure with Microsoft Entra ID. You need to ensure that users can access on-premises applications using passwordless authentication and that the solution minimizes latency for authentication requests. What should you implement?
Quick Answer
The answer is to use Microsoft Entra application proxy to publish the on-premises apps and enable passwordless authentication. This solution is correct because Entra application proxy acts as a reverse proxy, securely routing user requests from the cloud to on-premises web applications without requiring a VPN, and it fully integrates with Microsoft Entra ID’s passwordless authentication methods—such as FIDO2 security keys or Windows Hello for Business—so users never need to enter a password. On the Microsoft Cybersecurity Architect exam, this question tests your ability to design a hybrid identity infrastructure that balances security with low latency; the common trap is choosing VPN, which adds network overhead and doesn’t natively support passwordless flows, or confusing Web Application Proxy (a legacy on-premises component) with the cloud-native Entra application proxy. Remember the memory tip: “Proxy for passwordless, VPN for stress”—the proxy eliminates both passwords and latency.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Microsoft Entra application proxy to publish the on-premises applications and enable passwordless authentication.
Microsoft Entra application proxy provides secure remote access to on-premises web applications by publishing them through the Microsoft Entra ID service. It allows users to authenticate using passwordless methods (e.g., Windows Hello, FIDO2, Microsoft Authenticator) and minimizes latency by proxying requests through Microsoft's infrastructure without requiring a VPN. Option A is incorrect because Microsoft Entra Domain Services is for domain-joined VMs, not for publishing applications. Option C is incorrect because Web Application Proxy is a legacy on-premises component that does not integrate with passwordless authentication and lacks the software-defined perimeter capabilities of Entra application proxy. Option D is incorrect because VPNs introduce latency and do not inherently support passwordless authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Join the on-premises servers to Microsoft Entra Domain Services and use passwordless authentication.
Why it's wrong here
Incorrect. Microsoft Entra Domain Services provides managed domain services but does not publish on-premises applications.
- ✓
Use Microsoft Entra application proxy to publish the on-premises applications and enable passwordless authentication.
Why this is correct
Correct. Microsoft Entra application proxy publishes on-premises apps and supports passwordless authentication with low latency.
- ✗
Install Web Application Proxy (WAP) on-premises and integrate with Microsoft Entra ID for passwordless.
Why it's wrong here
Incorrect. Web Application Proxy is a legacy on-premises component that does not integrate with passwordless authentication.
- ✗
Deploy a VPN and use Microsoft Entra ID with passwordless sign-in.
Why it's wrong here
Incorrect. VPN adds latency and does not natively support passwordless authentication.
Go deeper
Related to this question
About these practice questions
This SC-100 question is part of Courseiva's 208-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-100
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are designing a hybrid identity solution for an organization that uses Microsoft Entra ID and an on-premises Active Directory. The organization requires that users who are located in a remote office without a direct VPN connection to the main office can authenticate against on-premises resources using their Entra ID credentials. The solution must minimize latency and support passwordless authentication. Which feature should you implement?
medium- A.Configure Microsoft Entra Application Proxy
- ✓ B.Implement Microsoft Entra Kerberos authentication
- C.Enable Microsoft Entra Conditional Access policies
- D.Deploy Microsoft Entra Connect Sync with password hash synchronization
Why B: Microsoft Entra Kerberos authentication enables users to authenticate to on-premises resources using their Entra ID credentials without requiring a VPN, and it supports passwordless methods like FIDO2 and Windows Hello for Business. Option A is incorrect because Entra Application Proxy is designed for publishing on-premises web applications, not for general authentication. Option C is incorrect because Conditional Access policies enforce access controls but do not provide authentication or passwordless capabilities. Option D is incorrect because Entra Connect Sync with password hash synchronization only syncs password hashes and does not support real-time passwordless authentication without a VPN.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.