Describe the capabilities of Microsoft Entra →mediumMultiple ChoiceObjective-mapped

SC-900 Describe the capabilities of Microsoft Entra Practice Question

Your company uses Microsoft Entra ID and wants to implement a passwordless authentication strategy for all users. You have a mix of Windows 10 devices, iOS devices, and Android devices. You need a solution that works across all platforms and does not require users to remember passwords. What should you implement?

⚠ Common exam trap

It's easy for candidates to assume FIDO2 security keys (Option A) are the only true passwordless solution, but they overlook the cross-platform limitation and the fact that Microsoft Authenticator also implements FIDO2/WebAuthn, making it the more practical choice for heterogeneous device environments.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Deploy Microsoft Authenticator with phone sign-in enabled for all users.

Microsoft Authenticator with phone sign-in enabled provides a cross-platform passwordless authentication solution that works on Windows 10, iOS, and Android devices. It uses a key-based authentication model where the user's phone generates a cryptographic key pair, eliminating the need for passwords while supporting all required device types.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Deploy FIDO2 security keys to all users and register them in Microsoft Entra ID.
Why it's wrong here
FIDO2 security keys offer strong, phishing-resistant authentication by using public-key cryptography and requiring a physical presence or biometric verification. However, deploying these physical hardware tokens to all users presents significant logistical and cost challenges, as each user requires a dedicated key. Furthermore, their hardware dependency means they are not inherently mobile-friendly across diverse personal devices like smartphones and tablets, limiting universal adoption for all authentication scenarios.
✓
Deploy Microsoft Authenticator with phone sign-in enabled for all users.
Why this is correct
Deploying Microsoft Authenticator with phone sign-in provides a highly scalable and user-friendly passwordless solution by leveraging users' existing smartphones. This method supports cross-platform compatibility across Windows, iOS, and Android devices, enabling a consistent authentication experience without requiring passwords. Users simply approve a notification on their mobile device, making it an efficient and broadly applicable choice for an entire organization.
✗
Implement certificate-based authentication using smart cards.
Why it's wrong here
Implementing certificate-based authentication using smart cards requires a complex Public Key Infrastructure (PKI) and the distribution of physical smart cards to every user. Additionally, each device used for authentication must be equipped with a compatible smart card reader, which is not feasible for mobile devices like smartphones or tablets. This extensive hardware and infrastructure dependency makes it an impractical solution for universal deployment across a diverse device ecosystem.
✗
Enable Windows Hello for Business on all Windows devices.
Why it's wrong here
While Windows Hello for Business offers robust, passwordless authentication through biometrics or a PIN, its functionality is strictly limited to Windows devices. It does not extend to other critical platforms such as iOS or Android, which are commonly used by employees for accessing corporate resources. Therefore, enabling Windows Hello for Business alone would fail to provide a comprehensive, universal authentication solution for all users across their entire range of devices.

Go deeper

SC-900 Describe the capabilities of Microsoft Entra Practice Question

Why each option matters

Option-by-option breakdown

Related to this question