SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company is planning to migrate from on-premises Active Directory to Microsoft Entra ID. They have multiple on-premises applications that use LDAP for authentication. They want to enable single sign-on (SSO) to these applications from the cloud without modifying the applications. Which approach should they use?
⚠ Common exam trap
A common mix-up: candidates confuse authentication methods (like Pass-through or Federation) with directory services, not realizing that legacy LDAP-based applications require a domain service that exposes an LDAP endpoint, not just a cloud authentication protocol.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra Domain Services
Microsoft Entra Domain Services provides managed domain services such as LDAP, Kerberos, and NTLM authentication without requiring you to deploy and manage domain controllers. Since the on-premises applications use LDAP for authentication and cannot be modified, Entra Domain Services can be used to lift and shift these applications into Azure while enabling SSO from the cloud, as it presents a compatible LDAP interface that the applications can continue to use.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Entra Domain Services
Why this is correct
Microsoft Entra Domain Services provides a managed domain environment that is fully compatible with traditional Active Directory Domain Services (AD DS). It offers essential domain services like LDAP, Kerberos, and NTLM authentication, which are critical for legacy applications that cannot be easily re-architected to use modern authentication protocols. This service allows companies to lift-and-shift these applications to the cloud without deploying or managing domain controllers, while still leveraging their existing Microsoft Entra ID identities for authentication and directory lookups.
- ✗
Federation with Active Directory Federation Services (AD FS)
Why it's wrong here
Federation with Active Directory Federation Services (AD FS) is primarily designed for identity federation and single sign-on using modern authentication protocols such as SAML 2.0 and WS-Federation. While it can integrate with Microsoft Entra ID, AD FS itself does not provide traditional LDAP endpoints or Kerberos/NTLM authentication directly to applications. Legacy applications requiring these protocols would necessitate significant re-architecture or would not function, making it unsuitable for a direct migration of such dependencies.
- ✗
Pass-through authentication
Why it's wrong here
Pass-through authentication (PTA) is a hybrid identity solution that allows users to sign in to Microsoft Entra ID using their on-premises Active Directory credentials. It achieves this by routing authentication requests through lightweight agents installed on-premises to validate against the local AD DS. However, PTA is solely an an authentication method for Microsoft Entra ID and does not expose traditional domain services like LDAP, Kerberos, or NTLM directly to applications, thus failing to support legacy applications dependent on these protocols.
- ✗
Password hash synchronization with Seamless SSO
Why it's wrong here
Password hash synchronization (PHS) is a hybrid identity method that copies a hash of users' on-premises Active Directory passwords to Microsoft Entra ID, enabling cloud-based authentication. While Seamless Single Sign-On (SSO) enhances the user experience by automatically signing them in when on corporate networks, PHS fundamentally does not provide a managed domain environment or expose traditional domain services. It does not offer LDAP, Kerberos, or NTLM endpoints for applications, making it unsuitable for legacy applications requiring these protocols to function.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
LDAP
LDAP is a protocol used to access and manage directory information over a network, such as user accounts and permissions.
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.