SC-900 Describe the capabilities of Microsoft Entra Practice Question
You are the identity administrator for a large enterprise using Microsoft Entra ID. The company has 50,000 users and recently acquired a smaller company with 2,000 users that uses a third-party identity provider (IdP) based on SAML 2.0. The acquisition must be fully integrated within 30 days. The CISO mandates that all users must use MFA for any access to cloud applications. The acquired company's users currently do not use MFA. You need to choose an approach that minimizes changes to the acquired company's current authentication infrastructure while meeting the MFA requirement. The solution must also allow the acquired company's users to access resources in the parent tenant using their existing credentials. What should you do?
⚠ Common exam trap
It's easy for candidates to assume B2B collaboration cannot enforce MFA for guest users, or they mistakenly think password hash synchronization is a valid option for a third-party SAML IdP, when in fact PHS is only applicable to on-premises Active Directory environments.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure B2B collaboration with the acquired company's IdP and enable MFA trust. In the parent tenant, create a Conditional Access policy that requires MFA for guest users.
B2B collaboration allows the acquired company's users to authenticate against their existing SAML 2.0 IdP using their current credentials, minimizing infrastructure changes. By enabling MFA trust, the parent tenant can rely on the MFA claims already issued by the third-party IdP if it supports MFA, but since it does not, you can enforce MFA in the parent tenant via a Conditional Access policy that requires MFA for guest users. This approach meets the CISO's mandate without requiring the acquired company to deploy MFA on their own IdP or migrate users.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure B2B collaboration with the acquired company's IdP and enable MFA trust. In the parent tenant, create a Conditional Access policy that requires MFA for guest users.
Why this is correct
This option leverages Microsoft Entra B2B collaboration with direct federation, allowing users from the acquired company to authenticate using their existing Identity Provider (IdP) without migrating accounts. Enabling MFA trust ensures that the parent tenant can either accept MFA claims from the acquired company's IdP or enforce its own MFA. A Conditional Access policy then specifically targets these guest users, mandating MFA for access to resources, providing a secure and efficient integration.
- ✗
Set up password hash synchronization from the acquired company's IdP to the parent tenant and enable MFA for all sync'ed users.
Why it's wrong here
Password Hash Synchronization (PHS) is primarily designed for synchronizing identities from an on-premises Active Directory to Microsoft Entra ID, not for direct integration with an external Identity Provider (IdP) in a separate tenant. Implementing PHS from an external IdP would require the acquired company to fundamentally alter their existing authentication infrastructure to expose password hashes, which is typically not supported, secure, or practical for cross-tenant collaboration.
- ✗
Create new user accounts in the parent tenant for the acquired company's users and assign them Microsoft Entra ID P2 licenses to enable MFA via Conditional Access.
Why it's wrong here
Creating new user accounts in the parent tenant for every user from the acquired company would result in duplicate identities and a poor user experience, as users would need to manage new credentials. This approach significantly increases administrative overhead for the parent tenant, including account provisioning, password resets, and ongoing lifecycle management, making it inefficient and cumbersome compared to leveraging existing external identities.
- ✗
Migrate all acquired company users to the parent tenant's on-premises Active Directory and sync them to Microsoft Entra ID. Enable MFA via Conditional Access.
Why it's wrong here
Migrating all user accounts, including their attributes and potentially their associated data, from the acquired company's infrastructure to the parent tenant's on-premises Active Directory is an extremely complex, time-consuming, and disruptive process. This extensive migration effort would involve significant planning, potential downtime, and substantial resource allocation, making it highly impractical for a rapid integration requirement and unlikely to meet a tight deadline.
Go deeper
Related to this question
Learn chapter
Identity Concepts
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.