SC-900 Describe the capabilities of Microsoft Entra Practice Question
An organization is migrating from on-premises Active Directory to Microsoft Entra ID. They need to synchronize user passwords so that users can use the same password for both on-premises and cloud resources. Which authentication method should they choose?
⚠ Common exam trap
Test-takers frequently confuse 'synchronization' with 'single sign-on' or 'pass-through validation,' assuming that Seamless SSO or Pass-through Authentication also synchronize passwords, when in fact they do not transfer password hashes to the cloud.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Password Hash Synchronization
Password Hash Synchronization (PHS) is the correct choice because it synchronizes a hash of the user's on-premises Active Directory password to Microsoft Entra ID, allowing users to authenticate with the same password for both on-premises and cloud resources. This method is specifically designed for password synchronization without requiring any additional infrastructure or real-time validation against on-premises systems.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Password Hash Synchronization
Why this is correct
Password Hash Synchronization (PHS) is a cloud authentication method that securely synchronizes a cryptographic hash of a user's password from an on-premises Active Directory to Azure AD. This allows users to sign in to cloud services using the same credentials they use on-premises, without exposing their actual passwords in the cloud. It provides a simple, robust solution for hybrid identity, enabling a seamless transition for users during migration while maintaining a cloud-managed authentication experience.
- ✗
Seamless Single Sign-On
Why it's wrong here
Seamless Single Sign-On (SSO) is a user experience feature, not a primary authentication method itself. It works in conjunction with Password Hash Synchronization (PHS) or Pass-through Authentication (PTA) to automatically sign users into Azure AD-connected applications when they are on a corporate network. By leveraging Kerberos, SSO eliminates the need for users to re-enter their passwords, enhancing convenience but relying on an underlying authentication mechanism.
- ✗
Pass-through Authentication
Why it's wrong here
Pass-through Authentication (PTA) is a cloud authentication method where Azure AD agents installed on-premises validate user sign-in requests directly against the on-premises Active Directory. Unlike PHS, PTA does not synchronize password hashes to Azure AD; instead, it provides real-time validation, ensuring that only the on-premises AD holds the authoritative password. This method requires continuous connectivity to the on-premises environment for authentication to succeed.
- ✗
Federation with AD FS
Why it's wrong here
Federation with AD FS involves delegating authentication to an on-premises Active Directory Federation Services (AD FS) infrastructure. When a user attempts to access an Azure AD resource, they are redirected to the AD FS server for authentication, which then issues a security token to Azure AD. This method requires significant on-premises infrastructure and management, offering advanced conditional access capabilities but not involving direct password synchronization to Azure AD.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.