SC-900 Describe the capabilities of Microsoft Entra Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Configure single sign-on (SSO) using federation

  Why this is correct

  Configuring single sign-on (SSO) using federation establishes a trust relationship where Microsoft Entra ID acts as the identity provider. When users access an application, they are redirected to Entra ID for authentication. Upon successful verification, Entra ID issues a security token to the application, granting access without the application ever storing or directly handling the user's password, thereby centralizing authentication and eliminating application-specific credential storage.

• ✗

  Deploy Microsoft Entra Self-Service Password Reset

  Why it's wrong here

  Deploying Microsoft Entra Self-Service Password Reset (SSPR) empowers users to reset their forgotten or locked passwords for their Entra ID accounts without administrator intervention. While SSPR significantly improves user productivity and reduces help desk calls, it primarily addresses password management for the *Entra ID account itself*. It does not alter how individual applications handle or store credentials, nor does it eliminate the need for applications to manage their own authentication mechanisms if they are not integrated with Entra ID for SSO.

• ✗

  Configure conditional access policies with MFA

  Why it's wrong here

  Configuring Conditional Access policies with Multi-Factor Authentication (MFA) enhances security by requiring additional verification steps based on specific conditions, such as location or device compliance. While MFA significantly strengthens the authentication process by making it harder for unauthorized users to gain access, it is a *security layer on top of authentication*. It does not inherently change the underlying mechanism of how applications store or manage user credentials; the application would still need to process the initial authentication request, potentially involving its own password storage, before MFA is enforced by Entra ID.

• ✗

  Enable Microsoft Entra Identity Protection

  Why it's wrong here

  Enabling Microsoft Entra Identity Protection is a security feature that detects potential vulnerabilities affecting an organization's identities, such as leaked credentials, impossible travel, or anomalous sign-in activities. It provides risk-based policies to automatically respond to these threats, for instance, by blocking sign-ins or requiring MFA. However, Identity Protection focuses on *detecting and remediating identity-based risks* and does not directly address or eliminate the need for applications to store or manage user passwords.

Go deeper

Related to this question