SC-900 Describe the capabilities of Microsoft Entra Practice Question
Your organization uses Microsoft Entra ID free tier. You need to synchronize user accounts from your on-premises Active Directory to the cloud. You also need to synchronize password hashes so that users can use the same password for cloud and on-premises resources. Which tool should you use?
⚠ Common exam trap
Candidates often confuse Microsoft Entra Domain Services with Microsoft Entra Connect, thinking that Domain Services can sync from on-premises AD, when in fact it only syncs from Entra ID to the managed domain, not the other way around.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Install Microsoft Entra Connect and enable password hash synchronization.
Microsoft Entra Connect is the correct tool for synchronizing on-premises Active Directory user accounts to Microsoft Entra ID (formerly Azure AD) and enabling password hash synchronization. Password hash synchronization allows users to use the same password for both on-premises and cloud resources by syncing a hash of the on-premises password to Entra ID, which is supported in the free tier of Entra ID.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure Microsoft Entra Domain Services to sync from on-premises.
Why it's wrong here
Microsoft Entra Domain Services provides managed domain services in Azure, offering LDAP, Kerberos, and NTLM compatibility for cloud-based applications. While it synchronizes identities *from* Microsoft Entra ID to provide domain services within Azure, it is not designed to be the primary synchronization mechanism for *on-premises* Active Directory to populate Microsoft Entra ID. Its purpose is to extend traditional AD capabilities to Azure VMs and applications, not to initially connect an on-premises directory to Microsoft Entra ID.
- ✗
Use Microsoft Graph API to create users and set passwords.
Why it's wrong here
The Microsoft Graph API is a powerful RESTful web API that allows programmatic access to Microsoft Entra ID resources, including creating and managing users, groups, and devices. However, it is an administrative interface for direct manipulation of cloud objects, not a synchronization engine designed to continuously replicate identities and password hashes from an on-premises Active Directory environment. Manually scripting user creation via Graph API would not establish ongoing identity synchronization.
- ✓
Install Microsoft Entra Connect and enable password hash synchronization.
Why this is correct
Microsoft Entra Connect is the official Microsoft tool specifically designed to synchronize user identities, groups, and other directory objects from an on-premises Active Directory to Microsoft Entra ID. Enabling password hash synchronization (PHS) within Entra Connect securely hashes and synchronizes user passwords from the on-premises AD to Microsoft Entra ID, allowing users to sign in to cloud services with their existing credentials without requiring additional infrastructure like federation. This is the standard and recommended method for hybrid identity.
- ✗
Deploy Active Directory Federation Services (AD FS) to enable single sign-on.
Why it's wrong here
Active Directory Federation Services (AD FS) is an on-premises identity provider that enables single sign-on by federating authentication requests from Microsoft Entra ID back to the on-premises Active Directory. While AD FS provides single sign-on, it does not synchronize user identities or password hashes to Microsoft Entra ID; instead, it relies on the on-premises AD for authentication during sign-in attempts. Furthermore, AD FS requires additional server infrastructure and is typically used for more complex hybrid scenarios or specific compliance requirements, not for basic password synchronization.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Microsoft Entra Connect
Microsoft Entra Connect is a tool that synchronizes on-premises Active Directory identities with Microsoft Entra ID (formerly Azure AD) to enable single sign-on and centralized identity management.
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.