SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company is planning to migrate from on-premises Active Directory to Microsoft Entra ID. They have a custom line-of-business application that uses Windows Integrated Authentication and requires Kerberos. Which approach should they use to enable hybrid identity?
⚠ Common exam trap
Candidates often assume that any hybrid identity scenario requires federation (ADFS) or that modern protocols like OAuth/SAML can always replace Kerberos, but Microsoft Entra Kerberos authentication is specifically designed to support legacy Kerberos-dependent apps without federation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy Microsoft Entra Kerberos authentication and register the app
Microsoft Entra Kerberos authentication enables hybrid identity for legacy on-premises applications that require Kerberos and Windows Integrated Authentication. By deploying this feature, the app can authenticate users against Microsoft Entra ID while still receiving Kerberos tickets, allowing a seamless migration without modifying the application's authentication code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Deploy Microsoft Entra Kerberos authentication and register the app
Why this is correct
Deploying Microsoft Entra Kerberos authentication is the correct approach because it enables Microsoft Entra ID to issue Kerberos tickets for on-premises applications. This feature allows users authenticated by Entra ID to access legacy applications that rely on Kerberos for authentication, without requiring a direct line of sight to a traditional Active Directory domain controller from the client. It effectively bridges the gap between cloud-managed identities and on-premises Kerberos-dependent resources, often in conjunction with the Microsoft Entra application proxy for remote access.
- ✗
Use password hash synchronization (PHS) and configure the app for OAuth
Why it's wrong here
Using password hash synchronization (PHS) is insufficient because PHS only synchronizes a hash of the user's password to Microsoft Entra ID for cloud authentication. It does not provide the necessary Kerberos Key Distribution Center (KDC) functionality or issue Kerberos tickets required by on-premises applications for authentication. Configuring an application for OAuth, while a modern authentication protocol, does not address the fundamental requirement of legacy on-premises applications that are hardcoded to use Kerberos for their authentication mechanism.
- ✗
Use pass-through authentication (PTA) and configure the app for SAML
Why it's wrong here
Pass-through authentication (PTA) is not suitable as it merely forwards authentication requests to an on-premises agent, which then validates credentials against Active Directory. While it authenticates users against their on-premises passwords, PTA does not generate or provide Kerberos tickets needed by on-premises applications. Similarly, configuring an application for SAML (Security Assertion Markup Language) facilitates federated web-based single sign-on but does not provide the underlying Kerberos protocol support required for legacy on-premises applications.
- ✗
Federate with Active Directory Federation Services (ADFS)
Why it's wrong here
Federating with Active Directory Federation Services (ADFS) could technically provide Kerberos-related capabilities, often through Kerberos Constrained Delegation (KCD) in specific scenarios. However, ADFS introduces significant on-premises infrastructure, management overhead, and complexity, requiring dedicated servers and ongoing maintenance. Microsoft Entra Kerberos offers a more direct, cloud-native, and streamlined solution for enabling Kerberos authentication for hybrid applications, reducing the need for extensive on-premises federation infrastructure.
Go deeper
Related to this question
Learn chapter
Identity Concepts
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
Key term
Identity
Identity is the unique set of attributes that defines a user, device, or service in a computer system, determining what they can access and do.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.