SC-900 Describe the capabilities of Microsoft Entra Practice Question
Your organization has multiple on-premises directories and wants to synchronize them to Microsoft Entra ID. However, you must avoid duplicate user objects. Which feature should you configure?
⚠ Common exam trap
A common mix-up: candidates confuse features that handle authentication (Password Hash Sync, Pass-through Authentication, AD FS) with the identity-mapping mechanism (source anchor) that prevents duplicate objects during synchronization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Source anchor attribute
The source anchor attribute (often the objectGUID in on-premises directories) is used during synchronization to uniquely identify each object and prevent duplicates. By mapping each on-premises object to a single, immutable source anchor, Microsoft Entra Connect ensures that even if multiple directories contain the same user, only one corresponding object is created in Entra ID.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Password Hash Sync
Why it's wrong here
Password Hash Sync (PHS) is an Microsoft Entra Connect authentication method that synchronizes a hash of the user's on-premises password to Microsoft Entra ID. While it enables users to sign in to Microsoft Entra ID with their on-premises credentials, its function is solely credential synchronization. PHS does not provide a mechanism for uniquely identifying or de-duplicating user objects originating from multiple distinct on-premises directories before they are provisioned into Microsoft Entra ID.
- ✗
Pass-through Authentication
Why it's wrong here
Pass-through Authentication (PTA) is an Microsoft Entra Connect authentication method where user sign-in requests are validated directly against the on-premises Active Directory by an agent. Similar to PHS, PTA focuses on authenticating users using their existing on-premises passwords. It does not address the challenge of consolidating or uniquely identifying user identities across multiple disparate on-premises directories to prevent the creation of duplicate user accounts in Microsoft Entra ID during synchronization.
- ✗
Active Directory Federation Services
Why it's wrong here
Active Directory Federation Services (ADFS) is an on-premises identity solution that provides federated identity management and single sign-on capabilities, acting as an identity provider. While ADFS can be used for authentication in hybrid environments, it is an authentication method, not a synchronization component designed to resolve or prevent duplicate user identities. ADFS relies on existing identities and does not inherently de-duplicate user objects that might be synchronized from multiple distinct on-premises directories into a single Microsoft Entra ID tenant.
- ✓
Source anchor attribute
Why this is correct
The source anchor attribute, also known as `immutableId` in Microsoft Entra ID, is a critical attribute used by Microsoft Entra Connect to uniquely identify an object across both the on-premises Active Directory and Microsoft Entra ID. When synchronizing from multiple on-premises directories, Microsoft Entra Connect uses this attribute to establish a persistent, unique link for each object. This ensures that each on-premises object maps to a single, unique object in Microsoft Entra ID, effectively preventing the creation of duplicate identities for the same user or group.
Go deeper
Related to this question
Learn chapter
Hybrid Identity with Entra Connect
Key term
Microsoft Entra Connect
Microsoft Entra Connect is a tool that synchronizes on-premises Active Directory identities with Microsoft Entra ID (formerly Azure AD) to enable single sign-on and centralized identity management.
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,279 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.