SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company is implementing a Microsoft Entra ID tenant for a new subsidiary. They require that all users authenticate using passwordless methods, specifically the Microsoft Authenticator app. What is the minimum configuration required to enforce this?
⚠ Common exam trap
Candidates often confuse 'MFA registration' or 'Security defaults' with enforcing a specific authentication method, but neither restricts the method to passwordless only, which is the key requirement in the question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Conditional Access policy targeting all users that requires 'Require authentication strength' and select the 'Passwordless MFA' authentication strength
A Conditional Access policy with the 'Require authentication strength' setting allows you to select the 'Passwordless MFA' authentication strength, which enforces passwordless methods like the Microsoft Authenticator app. This is the minimum configuration that directly targets all users and mandates passwordless authentication, as opposed to broader or less specific settings.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable Microsoft Entra ID Protection and configure MFA registration policy
Why it's wrong here
Enabling Microsoft Entra ID Protection helps detect and remediate identity-based risks, and an MFA registration policy ensures users enroll in multi-factor authentication methods. However, neither of these directly prevents users from initiating a sign-in with a password as their primary credential. While they enhance security by requiring a second factor or mitigating risks, they do not enforce a truly passwordless experience by blocking password-based sign-ins altogether.
- ✗
Turn on Security defaults
Why it's wrong here
Security defaults provide a foundational level of security by enforcing multi-factor authentication for all users and blocking legacy authentication protocols. While they significantly improve an organization's security posture by ensuring a second factor is always used, they do not eliminate the use of passwords. Users can still provide their password as the initial authentication factor, meaning security defaults do not achieve a passwordless environment.
- ✗
Configure Microsoft Entra Hybrid Join for all devices
Why it's wrong here
Microsoft Entra Hybrid Join integrates on-premises Active Directory-joined devices with Microsoft Entra ID, enabling features like device-based Conditional Access and seamless single sign-on. However, device join state is distinct from authentication method enforcement. Hybrid Join does not inherently provide or enforce passwordless authentication mechanisms like FIDO2 security keys or Windows Hello for Business, nor does it block password-based sign-ins.
- ✓
Create a Conditional Access policy targeting all users that requires 'Require authentication strength' and select the 'Passwordless MFA' authentication strength
Why this is correct
This is the correct approach because Microsoft Entra Conditional Access policies, combined with authentication strengths, are designed to enforce specific authentication methods. By configuring a policy to 'Require authentication strength' and selecting 'Passwordless MFA', administrators can explicitly mandate that users authenticate using only passwordless methods, such as FIDO2 security keys or Windows Hello for Business. This effectively blocks any sign-in attempt that relies on a password as the primary credential, thereby achieving a truly passwordless environment.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
MFA
Multi-Factor Authentication (MFA) is a security method that requires a user to verify their identity using two or more different types of evidence, such as a password plus a code from a phone, before they can access an account or system.
Key term
Passwordless authentication
Passwordless authentication is a method of verifying a user's identity without requiring them to enter a password, using alternative factors like biometrics, hardware tokens, or one-time codes.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.