SC-900 Describe the capabilities of Microsoft Entra Practice Question
Your company is implementing a passwordless authentication strategy. You want users to be able to sign in using the Microsoft Authenticator app on their mobile devices. Which Microsoft Entra feature should you enable?
⚠ Common exam trap
Test-takers frequently confuse 'passwordless' with any non-password method, but the question specifically requires the Microsoft Authenticator app, which eliminates Windows Hello for Business (device-bound) and FIDO2 (hardware-bound) as valid options.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Passwordless phone sign-in with Microsoft Authenticator
Passwordless phone sign-in with Microsoft Authenticator allows users to sign in without entering a password by approving a notification or entering a number displayed on the screen. This directly aligns with the requirement to use the Microsoft Authenticator app on mobile devices for a passwordless authentication strategy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Windows Hello for Business
Why it's wrong here
Windows Hello for Business provides strong, two-factor authentication for Windows devices by combining a user gesture (PIN, biometric) with a cryptographic key tied to the device's Trusted Platform Module (TPM). While it offers a passwordless experience, its scope is limited to Windows endpoints and does not extend to mobile devices or web browsers directly, making it unsuitable as a universal passwordless solution for all user scenarios.
- ✓
Passwordless phone sign-in with Microsoft Authenticator
Why this is correct
Passwordless phone sign-in with Microsoft Authenticator leverages the user's mobile device as a second factor and a cryptographic key. When attempting to sign in, the user receives a notification on their Authenticator app, which they approve by matching a number or using biometrics, effectively eliminating the need to type a password. This method offers a convenient, secure, and widely applicable passwordless experience across various applications and services integrated with Azure Active Directory.
- ✗
FIDO2 security keys
Why it's wrong here
FIDO2 security keys are physical hardware devices that provide strong, phishing-resistant passwordless authentication by storing cryptographic credentials. Users authenticate by inserting the key and performing a gesture, such as a touch or PIN entry. While highly secure and a valid passwordless option, FIDO2 keys require users to possess and carry a dedicated hardware token, which can be less convenient or scalable than a software-based mobile app solution for broad enterprise deployment.
- ✗
Temporary Access Pass
Why it's wrong here
A Temporary Access Pass (TAP) is a time-limited passcode issued by an administrator, designed primarily for initial user provisioning, account recovery, or when a user loses their primary authentication method. It enables a one-time, passwordless sign-in to register other strong authentication methods like Microsoft Authenticator or FIDO2 keys. TAP is not intended as a permanent or primary passwordless authentication method for daily use due to its temporary nature and administrative overhead.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
Key term
Passwordless authentication
Passwordless authentication is a method of verifying a user's identity without requiring them to enter a password, using alternative factors like biometrics, hardware tokens, or one-time codes.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.