SC-900 Describe the capabilities of Microsoft Entra Practice Question
Your company is implementing a hybrid identity solution with Microsoft Entra ID. Users report that they can sign in to Microsoft 365 but cannot access on-premises applications that are configured for integrated Windows authentication. You need to ensure seamless single sign-on (SSO) for both cloud and on-premises resources. What should you implement?
⚠ Common exam trap
A common mix-up: candidates confuse Passthrough Authentication or password hash synchronization with providing SSO for on-premises applications, but neither includes the Kerberos delegation required for Integrated Windows Authentication, which is the specific need in this scenario.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Microsoft Entra seamless SSO.
Microsoft Entra seamless SSO (Seamless SSO) is the correct choice because it automatically signs users in when they are on corporate devices connected to the corporate network, using Kerberos delegation to provide single sign-on for both cloud resources (like Microsoft 365) and on-premises applications configured for Integrated Windows Authentication (IWA). This eliminates the need for users to re-enter credentials when accessing on-premises apps after authenticating to the cloud.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement Passthrough Authentication.
Why it's wrong here
Implementing Passthrough Authentication (PTA) allows users to sign in to Microsoft Entra ID using their on-premises Active Directory passwords, with authentication requests forwarded to domain controllers. However, PTA alone does not inherently provide seamless single sign-on (SSO) for on-premises applications that rely on Integrated Windows Authentication (IWA). Users would still be prompted for credentials when accessing such on-premises resources, as PTA does not issue the necessary Kerberos tickets for silent authentication within the local network.
- ✗
Deploy Active Directory Federation Services (AD FS).
Why it's wrong here
Deploying AD FS is incorrect because it provides claims-based authentication and is not the direct solution for enabling seamless single sign-on to on-premises Integrated Windows Authentication applications when users are already authenticating with Microsoft Entra ID for cloud resources. It is tempting as AD FS *does* provide SSO capabilities and can federate with Microsoft Entra ID, making it suitable for organisations requiring complex, on-premises token issuance or strict control over the authentication flow for cloud services.
- ✓
Enable Microsoft Entra seamless SSO.
Why this is correct
Enabling Microsoft Entra seamless SSO is the correct solution as it provides automatic sign-in for users on corporate domain-joined devices connected to the corporate network. It achieves this by leveraging Kerberos, allowing users to silently authenticate to both cloud-based Microsoft Entra ID applications and on-premises applications configured for Integrated Windows Authentication (IWA) without re-entering their credentials. This mechanism ensures a true single sign-on experience across the hybrid environment.
- ✗
Configure password hash synchronization.
Why it's wrong here
Configuring password hash synchronization (PHS) is an authentication method that synchronizes a hash of users' on-premises Active Directory passwords to Microsoft Entra ID, enabling them to authenticate to cloud services. While PHS allows users to use the same credentials for cloud resources, it does not provide any mechanism for seamless single sign-on to on-premises applications. It does not generate Kerberos tickets or facilitate automatic authentication for local network resources that depend on Integrated Windows Authentication.
Go deeper
Related to this question
Learn chapter
Identity Concepts
Key term
Hybrid identity
Hybrid identity is an approach that synchronizes and manages user identities across both on-premises directories and cloud-based services, allowing seamless access to resources in both environments.
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.