Design security operations, identity, and compliance capabilities →easyMultiple ChoiceObjective-mapped
SC-100 Practice Question: Design security operations, identity, and compliance capabilities
You need to design a solution to synchronize on-premises Active Directory users to Microsoft Entra ID for hybrid identity. Which tool should you use?
⚠ Common exam trap
Test-takers frequently confuse Microsoft Entra Connect Cloud Sync with the full Entra Connect tool, assuming the 'Cloud Sync' name implies it is the primary or newer replacement, but in reality, Entra Connect Cloud Sync is a lighter agent for specific multi-forest or limited scenarios, while Entra Connect remains the standard for full hybrid identity synchronization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra Connect
Microsoft Entra Connect is the correct tool for synchronizing on-premises Active Directory users to Microsoft Entra ID for hybrid identity because it provides a comprehensive, full-featured synchronization engine that supports password hash synchronization, pass-through authentication, and federation integration. It is the primary tool for hybrid identity scenarios where you need to synchronize a single on-premises AD forest to a single Entra ID tenant, handling attributes, password writeback, and device synchronization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Identity Manager (MIM)
Why it's wrong here
MIM is an identity and access management solution that automates lifecycle workflows, self-service, and access certification, and it does include a Synchronization Service. However, it is designed for complex, customized provisioning scenarios such as HR-driven attribute distribution or multi-forest integration, not as the standard, recommended tool for routinely synchronizing a single on-premises Active Directory forest to Entra ID. Microsoft's default sync utility for that is Entra Connect, making MIM an over-engineered and rarely-correct choice for this requirement.
- ✓
Microsoft Entra Connect
Why this is correct
Microsoft Entra Connect is the primary, purpose-built tool for synchronizing on-premises Active Directory identities to Microsoft Entra ID. It replicates user, group, and device objects, and supports password hash synchronization, pass-through authentication, and federation integration. As the successor to DirSync and Azure AD Sync, it's the standard first-party solution for hybrid identity, and it is the correct choice when a straightforward, sanctioned sync mechanism is required.
- ✗
Microsoft Entra Connect Cloud Sync
Why it's wrong here
Microsoft Entra Connect Cloud Sync uses a lightweight agent to sync users and groups, and it's especially useful for merging multiple disconnected forests or replacing existing sync solutions in branch environments. However, it is not the general-purpose default for a typical on-premises AD to Entra ID deployment; Microsoft recommends Entra Connect for common scenarios that require a single, feature-complete sync engine. Cloud Sync lacks some advanced capabilities like device writeback and is intended for specific topologies, so it's incorrect here.
- ✗
Active Directory Federation Services (AD FS)
Why it's wrong here
AD FS is a federation service that authenticates users by forwarding their claims to trusted relying parties, enabling single sign-on for web applications across organizational boundaries. It does not replicate directory objects, passwords, or groups; it only processes authentication requests. Therefore, it cannot synchronize on-premises AD to Entra ID and is fundamentally a different identity technology built for federated access, not directory synchronization.
Visual reference
Go deeper
Related to this question
About these practice questions
This SC-100 question is part of Courseiva's 208-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.