Design solutions that align with security best practices and priorities →mediumMultiple ChoiceObjective-mapped
Passwordless Authentication Strategy for Hybrid Identity
Wide World Importers uses Azure Active Directory (now Microsoft Entra ID) and Microsoft 365. They have a hybrid identity with password hash sync. They want to implement a passwordless authentication strategy to improve security and user experience. They have a mix of Windows 10/11 devices and mobile devices (iOS/Android). They also have some shared computers in kiosk mode. The solution must support all user scenarios and align with Microsoft's authentication best practices. What should you recommend?
Quick Answer
The correct recommendation is to implement Windows Hello for Business for Windows 10/11 devices, deploy Microsoft Authenticator for mobile devices, and use FIDO2 security keys for shared computers and kiosk scenarios, while enabling combined registration for self-service password reset and Microsoft Authenticator. This passwordless authentication strategy for hybrid identity works because it aligns with Microsoft’s authentication best practices by covering every user scenario: Windows Hello leverages the device’s TPM for strong, built-in biometric or PIN-based sign-in, Microsoft Authenticator provides a seamless phone-based passwordless experience on iOS and Android, and FIDO2 security keys offer a portable, hardware-backed solution for shared or kiosk environments where personal devices aren’t available. On the Microsoft Cybersecurity Architect exam, this question tests your ability to map Microsoft’s passwordless deployment tiers to real-world hybrid environments, with a common trap being to recommend SMS or OATH tokens, which are not truly passwordless. A useful memory tip is “Three pillars for hybrid: Hello for hardware, Authenticator for handhelds, FIDO2 for shared.”
⚠ Common exam trap
Watch out — candidates often assume SMS-based authentication or smart cards are acceptable passwordless methods, but Microsoft's best practices explicitly exclude SMS due to security weaknesses and smart cards due to lack of mobile device support, while FIDO2 keys are the only recommended solution for shared/kiosk computers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement Windows Hello for Business for Windows 10/11 devices. Deploy Microsoft Authenticator for mobile devices for passwordless sign-in. Use FIDO2 security keys for shared computers and kiosk scenarios. Enable combined registration for self-service password reset and Microsoft Authenticator.
It aligns with Microsoft's passwordless authentication best practices by using Windows Hello for Business for Windows 10/11 devices (which supports biometric and PIN-based sign-in), Microsoft Authenticator for mobile devices (enabling phone-sign-in passwordless authentication), and FIDO2 security keys for shared computers and kiosk scenarios (which provide hardware-backed, phishing-resistant credentials). Combined registration streamlines the user enrollment process for both SSPR and Microsoft Authenticator, ensuring a seamless deployment across all device types.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use SMS-based authentication for all users. Deploy OATH tokens for shared computers. Implement Azure AD Conditional Access to require passwordless for admins only.
Why it's wrong here
SMS is not passwordless; OATH tokens are an extra cost.
- ✗
Implement Windows Hello for Business for all Windows devices. Use smart cards for mobile devices. Use FIDO2 keys for shared computers.
Why it's wrong here
Smart cards are not practical for mobile devices; mobile devices need Authenticator.
- ✓
Implement Windows Hello for Business for Windows 10/11 devices. Deploy Microsoft Authenticator for mobile devices for passwordless sign-in. Use FIDO2 security keys for shared computers and kiosk scenarios. Enable combined registration for self-service password reset and Microsoft Authenticator.
Why this is correct
Comprehensive passwordless approach covering all device types.
- ✗
Use the Microsoft Authenticator app for all users. Configure passwordless sign-in with the app. Use QR codes for kiosk computers.
Why it's wrong here
Authenticator alone does not cover Windows Hello for Business for Windows devices.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-100 question from scratch — 208 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on SC-100
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is migrating its on-premises Active Directory to Microsoft Entra ID. They need to ensure that all user authentication for cloud apps uses passwordless methods. Which security best practice should they implement?
medium- ✓ A.Implement Microsoft Entra ID passwordless authentication
- B.Configure conditional access policies to block legacy authentication
- C.Enable Microsoft Entra ID Privileged Identity Management (PIM)
- D.Require multifactor authentication (MFA) for all users
Why A: The company's requirement is specifically to ensure all user authentication for cloud apps uses passwordless methods. Microsoft Entra ID passwordless authentication (e.g., Windows Hello for Business, FIDO2 security keys, or Microsoft Authenticator) directly eliminates passwords from the authentication flow, aligning with the stated goal. Other options, while enhancing security, do not enforce passwordless authentication.
Variation 2. Your company is migrating on-premises Active Directory to Microsoft Entra ID. The security team requires that users must use passwordless authentication methods for all sign-ins. Which Microsoft Entra ID feature should you enable to support passwordless authentication?
medium- ✓ A.Microsoft Entra ID passwordless authentication methods
- B.Password hash synchronization
- C.Seamless Single Sign-On (Seamless SSO)
- D.Pass-through authentication
Why A: Microsoft Entra ID passwordless authentication methods (such as Windows Hello for Business, FIDO2 security keys, and Microsoft Authenticator) are the native features designed to eliminate passwords entirely. These methods satisfy the security team's requirement by enabling users to sign in without a password, using biometrics or cryptographic keys instead.
Variation 3. Your organization is migrating on-premises Active Directory to Microsoft Entra ID. You need to design a solution that aligns with the Zero Trust principle of 'verify explicitly'. Which approach should you recommend for user authentication?
medium- A.Deploy passwordless authentication using Microsoft Authenticator with phone sign-in for all users
- B.Enable users to sign in with Windows Hello for Business and allow password recovery via self-service
- C.Implement password hash synchronization and enforce MFA only for privileged users
- ✓ D.Deploy passwordless authentication using FIDO2 security keys for all users
Why D: D is correct because FIDO2 security keys provide phishing-resistant, passwordless authentication using hardware-bound cryptographic keys. This aligns with Zero Trust 'verify explicitly' by ensuring each sign-in uses strong, multi-factor verification without shared secrets. While Windows Hello for Business also offers similar phishing-resistant properties, it is often paired with password recovery (as in option B), which undermines a strict passwordless strategy. FIDO2 keys, when deployed for all users, provide the most consistent and explicit method of verifying identity.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.