SC-900 Describe the capabilities of Microsoft Entra Practice Question
Your company is implementing a passwordless authentication strategy. You want users to be able to sign in using the Microsoft Authenticator app on their mobile devices. Which Microsoft Entra feature should you enable?
⚠ Common exam trap
Test-takers frequently confuse 'passwordless' with any non-password method, but the question specifically requires the Microsoft Authenticator app, which eliminates Windows Hello for Business (device-bound) and FIDO2 (hardware-bound) as valid options.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Passwordless phone sign-in with Microsoft Authenticator
Passwordless phone sign-in with Microsoft Authenticator allows users to sign in without entering a password by approving a notification or entering a number displayed on the screen. This directly aligns with the requirement to use the Microsoft Authenticator app on mobile devices for a passwordless authentication strategy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Windows Hello for Business
Why it's wrong here
Windows Hello for Business provides strong, two-factor authentication for Windows devices by combining a user gesture (PIN, biometric) with a cryptographic key tied to the device's Trusted Platform Module (TPM). While it offers a passwordless experience, its scope is limited to Windows endpoints and does not extend to mobile devices or web browsers directly, making it unsuitable as a universal passwordless solution for all user scenarios.
- ✓
Passwordless phone sign-in with Microsoft Authenticator
Why this is correct
Passwordless phone sign-in with Microsoft Authenticator leverages the user's mobile device as a second factor and a cryptographic key. When attempting to sign in, the user receives a notification on their Authenticator app, which they approve by matching a number or using biometrics, effectively eliminating the need to type a password. This method offers a convenient, secure, and widely applicable passwordless experience across various applications and services integrated with Microsoft Entra ID.
- ✗
FIDO2 security keys
Why it's wrong here
FIDO2 security keys are physical hardware devices that provide strong, phishing-resistant passwordless authentication by storing cryptographic credentials. Users authenticate by inserting the key and performing a gesture, such as a touch or PIN entry. While highly secure and a valid passwordless option, FIDO2 keys require users to possess and carry a dedicated hardware token, which can be less convenient or scalable than a software-based mobile app solution for broad enterprise deployment.
- ✗
Temporary Access Pass
Why it's wrong here
A Temporary Access Pass (TAP) is a time-limited passcode issued by an administrator, designed primarily for initial user provisioning, account recovery, or when a user loses their primary authentication method. It enables a one-time, passwordless sign-in to register other strong authentication methods like Microsoft Authenticator or FIDO2 keys. TAP is not intended as a permanent or primary passwordless authentication method for daily use due to its temporary nature and administrative overhead.
Go deeper
Related to this question
Learn chapter
Self-Service Password Reset (SSPR)
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
Key term
Passwordless authentication
Passwordless authentication is a method of verifying a user's identity without requiring them to enter a password, using alternative factors like biometrics, hardware tokens, or one-time codes.
About these practice questions
One of 1,279 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.