SC-900 Describe the capabilities of Microsoft Entra Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Kerberos delegation

  Why it's wrong here

  Kerberos is an authentication protocol primarily designed for on-premises Active Directory environments, enabling single sign-on within a Windows domain. Kerberos delegation allows a service to impersonate a client to access another service on behalf of that client, but it is fundamentally an on-premises technology. It is not used for federated identity with cloud applications that typically rely on web-based protocols like SAML or OpenID Connect for cross-domain authentication, making it unsuitable for cloud-native or cloud-integrated custom line-of-business applications.

• ✗

  OpenID Connect authentication

  Why it's wrong here

  OpenID Connect (OIDC) is an identity layer built on top of the OAuth 2.0 authorization framework, primarily used for authentication and obtaining basic user profile information. While it is a modern and popular standard for web and mobile applications, it is a distinct protocol from SAML 2.0. An application configured to use SAML 2.0 for authentication cannot directly utilize OIDC without a separate implementation, as they operate with different message formats, endpoints, and underlying trust models, making them incompatible for direct interchange.

• ✗

  SCIM-based user provisioning

  Why it's wrong here

  The System for Cross-domain Identity Management (SCIM) is an open standard designed specifically for automating the exchange of user identity information between identity domains, such as Microsoft Entra ID and various SaaS applications. Its primary function is to provision, update, and deprovision user accounts and groups, ensuring consistent identity data across disparate systems. SCIM does not handle the authentication process itself; it merely manages the lifecycle of user identities, which is a separate concern from single sign-on (SSO) and user authentication.

• ✓

  SAML-based single sign-on

  Why this is correct

  SAML (Security Assertion Markup Language) 2.0 is an XML-based open standard for exchanging authentication and authorization data between an identity provider (IdP) and a service provider (SP). Microsoft Entra ID acts as a robust IdP, enabling users to sign in once and gain access to multiple enterprise applications (SPs) without re-entering credentials. This protocol is widely adopted for federated single sign-on with custom line-of-business applications and many SaaS applications, making it a secure, mature, and common solution for integrating enterprise applications with Microsoft Entra ID.

Go deeper

Related to this question