SC-900 Describe the capabilities of Microsoft Entra Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Microsoft Entra registered

  Why it's wrong here

  Microsoft Entra registered devices are typically personal or mobile devices, such as smartphones or tablets, that users bring to work (BYOD). While a work or school account is added, creating a device identity in Microsoft Entra ID for limited access to organizational resources, the device itself is not managed by the organization's directories. It remains under the user's personal control, offering a less stringent form of integration compared to joining a domain, primarily for secure access to specific applications.

  When this WOULD be correct

  A company uses only cloud apps (no on-premises AD) and wants users to sign in with personal Microsoft accounts or work accounts on BYOD devices to access corporate resources like email or SharePoint, without joining any domain.

• ✗

  Microsoft Entra joined

  Why it's wrong here

  Microsoft Entra joined devices are designed for cloud-native organizations or specific cloud-first scenarios, where devices are directly joined and managed by Microsoft Entra ID without any dependency on an on-premises Active Directory domain. These devices do not establish a trust relationship with a local AD, making them unsuitable for environments that still rely heavily on on-premises resources requiring traditional domain authentication. This model streamlines management for purely cloud-based operations, offering a modern alternative to traditional domain join.

  When this WOULD be correct

  A company uses only cloud-based applications and has no on-premises AD. They want new Windows 10 laptops to be joined directly to Microsoft Entra ID for cloud-only identity management, with no on-premises dependency.

• ✓

  Microsoft Entra hybrid joined

  Why this is correct

  Microsoft Entra hybrid joined devices are those that are joined to an on-premises Active Directory domain and simultaneously registered with Microsoft Entra ID. This configuration allows organizations to maintain existing on-premises management and group policies while enabling seamless single sign-on (SSO) to cloud resources and leveraging Microsoft Entra ID's conditional access policies. It effectively bridges the gap between traditional on-premises infrastructure and modern cloud services, providing a unified identity for devices across both environments.

• ✗

  On-premises domain join only

  Why it's wrong here

  Devices configured for on-premises domain join only possess an identity solely within the local Active Directory, managed exclusively by traditional Group Policy. They lack a corresponding device object in Microsoft Entra ID, which prevents them from directly accessing cloud-based resources with device-based conditional access or enjoying seamless single sign-on to Microsoft 365 and other SaaS applications. This setup significantly limits their integration with modern cloud security and management features, making them less suitable for hybrid environments.

  When this WOULD be correct

  An exam scenario where the requirement is solely to join devices to the on-premises Active Directory domain without any cloud integration, such as a company that does not use any cloud services and needs strict on-premises control.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question