SC-900 Describe the capabilities of Microsoft Entra Practice Question
Your company is migrating from on-premises Active Directory to Microsoft Entra ID. You need to synchronize user passwords and enable password writeback for self-service password reset. Which tool should you use?
⚠ Common exam trap
Watch out — candidates often confuse the deprecated name 'Azure AD Connect' (Option D) with the current tool, or mistakenly think that AD FS (Option C) can handle password synchronization and writeback, when in fact AD FS only handles authentication federation and not directory synchronization or writeback operations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra Connect Sync
Microsoft Entra Connect Sync (formerly Azure AD Connect) is the correct tool because it synchronizes on-premises Active Directory objects, including password hashes, to Microsoft Entra ID and supports password writeback, which enables self-service password reset (SSPR) to write changed passwords back to on-premises AD. The question specifically requires both password synchronization and writeback, which are core features of Entra Connect Sync.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Entra admin center
Why it's wrong here
The Microsoft Entra admin center is a web-based portal primarily used for managing cloud-based identities, services, and configurations within Microsoft Entra ID. While it allows for the administration of synchronized objects and settings, it does not perform the actual synchronization of identities, passwords, or other attributes from an on-premises Active Directory environment. Its primary function is post-synchronization management and configuration, not the initial data transfer mechanism.
- ✓
Microsoft Entra Connect Sync
Why this is correct
Microsoft Entra Connect Sync is the designated on-premises agent responsible for synchronizing user identities, groups, and other objects from an on-premises Active Directory to Microsoft Entra ID. It supports various synchronization features crucial for migration, including password hash synchronization (PHS), which securely transfers a hash of the on-premises password to the cloud, enabling single sign-on for users. This tool is fundamental for hybrid identity scenarios, ensuring a consistent user experience across both environments.
- ✗
Active Directory Federation Services (AD FS)
Why it's wrong here
Active Directory Federation Services (AD FS) is an on-premises identity solution primarily used for federated authentication, enabling single sign-on to applications outside the corporate network. While AD FS can integrate with Microsoft Entra ID for authentication, it does not perform the direct synchronization of user passwords or other identity attributes from on-premises Active Directory to Microsoft Entra ID. Its role is to authenticate users against on-premises AD and issue security tokens, not to replicate user data to the cloud directory.
- ✗
Azure AD Connect (deprecated)
Why it's wrong here
Azure AD Connect was the previous generation of the synchronization tool used to connect on-premises Active Directory with Azure Active Directory. Although it performed similar functions to its successor, it has been officially deprecated by Microsoft. Organizations are now required to use Microsoft Entra Connect Sync, which is the current, supported, and enhanced version of the synchronization agent, ensuring ongoing compatibility, security, and feature updates for hybrid identity deployments.
Visual reference
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Microsoft Entra Connect
Microsoft Entra Connect is a tool that synchronizes on-premises Active Directory identities with Microsoft Entra ID (formerly Azure AD) to enable single sign-on and centralized identity management.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.