SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A company uses an on-premises Active Directory (AD) and wants to enable single sign-on (SSO) for users to access Microsoft 365 and a third-party SaaS application. They plan to use an external identity provider (IdP) that supports Security Assertion Markup Language (SAML) 2.0. Which identity concept does this implementation primarily rely on?
⚠ Common exam trap
Many candidates confuse synchronization (e.g., Azure AD Connect) with federation, thinking that syncing user accounts alone enables SSO, but synchronization only copies identities without establishing the SAML trust required for federated authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Federation
Federation is the correct answer because it establishes a trust relationship between the on-premises Active Directory and the external identity provider (IdP) using SAML 2.0, enabling users to authenticate once and gain access to both Microsoft 365 and the third-party SaaS application without re-entering credentials. This relies on the IdP issuing SAML assertions that are trusted by the relying parties (Microsoft 365 and the SaaS app), which is the core mechanism of federated identity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Federation
Why this is correct
Federation establishes a trust relationship between an on-premises Active Directory and an external identity provider, such as Microsoft Entra ID, allowing users to authenticate once and gain access to multiple applications across different security domains. This process leverages industry standards like Security Assertion Markup Language (SAML) or OpenID Connect (OIDC) to exchange authentication and authorization data, enabling seamless Single Sign-On (SSO) without replicating user credentials. It specifically addresses the need for an on-premises AD to trust identities from another system for SSO.
- ✗
Provisioning
Why it's wrong here
Provisioning is the automated process of creating, updating, and deactivating user identities and their associated access rights across various systems and applications. While essential for lifecycle management, it focuses on the existence and attributes of user accounts within directories or applications, not on establishing the necessary trust relationship or authentication mechanism between an on-premises Active Directory and an external identity provider for Single Sign-On (SSO). It manages who has access, not how they authenticate across disparate systems.
- ✗
Synchronization
Why it's wrong here
Synchronization involves replicating user objects, groups, and their attributes between different directory services, such as between an on-premises Active Directory Domain Services (AD DS) and Microsoft Entra ID. Its primary function is to ensure data consistency across these directories. While crucial for hybrid identity scenarios, synchronization alone does not establish the necessary authentication trust or mechanism for users to achieve Single Sign-On (SSO) by authenticating against their on-premises AD and accessing resources secured by an external identity provider.
- ✗
Directory extension
Why it's wrong here
Directory extension allows administrators to add custom attributes to user, group, or device objects within Microsoft Entra ID, extending the schema beyond standard attributes. This feature is primarily used to store additional, application-specific information about directory objects. However, extending the directory schema has no direct bearing on establishing a trust relationship between an on-premises Active Directory and an external identity provider for Single Sign-On (SSO) or enabling cross-domain authentication.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Federation
Federation is a system that lets you use one set of login credentials (like your work email and password) to access resources across different organizations or services without needing separate accounts for each one.
Key term
Identity
Identity is the unique set of attributes that defines a user, device, or service in a computer system, determining what they can access and do.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.