SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Set up SAML-based federation in Microsoft Entra ID and assign a Conditional Access policy requiring MFA

  Why this is correct

  SAML-based federation is the industry standard for enabling Single Sign-On (SSO) between an identity provider like Microsoft Entra ID and external enterprise applications. By configuring SAML, users authenticate once with Microsoft Entra ID and gain seamless access to the application. Subsequently, a Conditional Access policy can be applied to this specific application, mandating multi-factor authentication (MFA) to enhance security before access is granted, ensuring compliance with organizational security postures.

• ✗

  Add the app as a Linked Sign-On application

  Why it's wrong here

  Linked Sign-On is designed for applications that already have an existing, non-Microsoft Entra ID based Single Sign-On solution or require a simple link to an external URL. This method does not involve Microsoft Entra ID acting as the identity provider for authentication, nor does it support direct integration with Microsoft Entra ID's security features like Conditional Access. Instead, it merely provides a launch point from the Microsoft Entra My Apps portal, redirecting users to the application's native login page or an external identity provider.

• ✗

  Use password-based SSO in Microsoft Entra ID

  Why it's wrong here

  Password-based Single Sign-On (SSO) involves Microsoft Entra ID securely storing and replaying user credentials to a legacy application's login form on behalf of the user. While it provides a form of SSO for applications that lack modern authentication protocols like SAML, it does not establish a federated trust relationship. This method is fundamentally incompatible with SAML, and therefore cannot be used to set up SAML-based federation or directly integrate with advanced security policies like Conditional Access requiring MFA.

• ✗

  Configure OAuth 2.0 authorization in Microsoft Entra ID

  Why it's wrong here

  OAuth 2.0 is an authorization framework primarily used for delegated access to protected resources, such as APIs, rather than for primary user authentication and Single Sign-On (SSO) to an application itself. While OpenID Connect builds on OAuth 2.0 to provide identity, OAuth 2.0 alone does not facilitate the direct federated authentication flow required for SAML-based SSO to an enterprise application. Therefore, configuring OAuth 2.0 would not enable the desired SAML federation or the enforcement of MFA via Conditional Access for application sign-in.

Go deeper

Related to this question