SC-900 Describe the capabilities of Microsoft Entra Practice Question
Your organization plans to migrate from on-premises Active Directory to Microsoft Entra ID. You need to design the identity synchronization strategy to support password hash synchronization and password writeback. Which tool should you use?
⚠ Common exam trap
Candidates often confuse Microsoft Entra Cloud Sync with Entra Connect, assuming Cloud Sync supports all the same features, but Cloud Sync lacks password writeback support, making it unsuitable for this requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra Connect
Microsoft Entra Connect is the correct tool because it supports both password hash synchronization and password writeback, which are required for the migration scenario. Password hash sync synchronizes a hash of the on-premises AD password to Entra ID, while password writeback enables password changes in the cloud to be written back to on-premises AD. Entra Connect is the primary hybrid identity tool that integrates on-premises directories with Microsoft Entra ID, offering these features natively.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Identity Manager
Why it's wrong here
Microsoft Identity Manager (MIM) is an on-premises identity management solution primarily used for provisioning, workflow automation, and synchronizing identities between disparate on-premises directories and systems. While MIM can manage identities within an enterprise, it is not designed as a direct cloud synchronization agent for Microsoft Entra ID and lacks the native capabilities for features like password hash synchronization or password writeback to the cloud.
- ✗
Active Directory Federation Services
Why it's wrong here
Active Directory Federation Services (AD FS) is an on-premises server role that provides federated identity and single sign-on (SSO) capabilities, allowing users to authenticate against their on-premises Active Directory to access cloud applications. AD FS is an authentication service that validates user credentials and issues security tokens, but it does not synchronize user accounts, passwords, or other identity attributes from on-premises Active Directory to Microsoft Entra ID.
- ✗
Microsoft Entra Cloud Sync
Why it's wrong here
Microsoft Entra Cloud Sync is a lightweight, agent-based synchronization solution designed for simpler Active Directory topologies, offering password hash synchronization from on-premises AD to Microsoft Entra ID. However, a significant limitation of Cloud Sync, especially for organizations requiring comprehensive hybrid identity management, is its lack of support for password writeback, which is essential for enabling self-service password reset (SSPR) to update on-premises passwords.
- ✓
Microsoft Entra Connect
Why this is correct
Microsoft Entra Connect is the comprehensive on-premises agent for synchronizing identities from Active Directory to Microsoft Entra ID, providing robust hybrid identity capabilities. It fully supports password hash synchronization, securely replicating a hash of the on-premises password to the cloud, and crucially, it enables password writeback, allowing self-service password reset (SSPR) changes in Microsoft Entra ID to update the user's password in on-premises Active Directory.
Visual reference
Go deeper
Related to this question
Learn chapter
Identity Concepts
Key term
Hybrid identity
Hybrid identity is an approach that synchronizes and manages user identities across both on-premises directories and cloud-based services, allowing seamless access to resources in both environments.
Key term
Identity
Identity is the unique set of attributes that defines a user, device, or service in a computer system, determining what they can access and do.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.