SC-900 Describe the capabilities of Microsoft Entra Practice Question
You are deploying Microsoft Entra Verified ID to issue verifiable credentials for employee onboarding. Which component is required to issue credentials?
⚠ Common exam trap
Watch out — candidates often confuse the need for a custom app registration (Option B) as the core requirement, but the DID is the mandatory cryptographic identity anchor without which no credentials can be issued.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A decentralized identifier (DID) for your organization
Microsoft Entra Verified ID requires a decentralized identifier (DID) for your organization to issue verifiable credentials. The DID serves as the cryptographic anchor that proves your organization's authority to issue credentials, as it is registered on a decentralized ledger (ION) and linked to your public keys. Without a DID, the verifiable credentials cannot be cryptographically signed and verified by relying parties.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A public key infrastructure (PKI) certificate
Why it's wrong here
PKI certificates are fundamentally centralized, relying on Certificate Authorities (CAs) to attest to an entity's identity and bind it to a public key. While PKI is crucial for secure communication (e.g., TLS), it is not the mechanism used to establish an issuer's verifiable identity within the decentralized Verified ID ecosystem. Decentralized Identifiers (DIDs) provide a self-sovereign, globally unique, and persistent identifier that does not depend on a hierarchical trust model like PKI.
- ✗
A custom application registered in Microsoft Entra ID
Why it's wrong here
A custom application registration in Microsoft Entra ID is primarily used for authenticating and authorizing access to Microsoft Entra Verified ID services and APIs. While an app registration is a necessary operational component for an organization to programmatically interact with the Verified ID platform, it does not serve as the cryptographic identifier for the organization as an issuer. The app registration facilitates access, whereas the Decentralized Identifier (DID) represents the verifiable identity of the issuer.
- ✓
A decentralized identifier (DID) for your organization
Why this is correct
A Decentralized Identifier (DID) is the foundational element for an organization to act as an issuer in Microsoft Entra Verified ID. This globally unique, self-owned identifier is published to a decentralized ledger (e.g., ION) and contains the public keys and service endpoints necessary for cryptographic operations, such as signing verifiable credentials. The DID cryptographically anchors the organization's verifiable identity, enabling holders and verifiers to trust the authenticity and integrity of the credentials issued.
- ✗
A blockchain node for the decentralized ledger
Why it's wrong here
Organizations deploying Microsoft Entra Verified ID are not required to operate or manage their own blockchain nodes. The underlying decentralized public key infrastructure, such as ION (which uses the Bitcoin blockchain for anchoring), is managed by Microsoft and its partners as a consortium network. Organizations interact with the Verified ID service, which abstracts away the complexities of direct blockchain interaction, handling DID resolution and anchoring on the decentralized ledger on their behalf.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.