SC-900 · Domain 2: Describe the capabilities of Microsoft Entra · 28% of the exam
Task 2.1: Describe function and identity types of Microsoft Entra ID
What Microsoft Entra ID is, tenants and directories, user, device, workload and agent identities, groups, hybrid identity with Cloud Sync, and external identities with External ID.
Study it
Microsoft Entra ID, tenants and directories
Lesson coming
User, device, workload and agent identities, and groups
Lesson coming
Hybrid identity with Microsoft Entra Cloud Sync
Lesson coming
External ID: B2B collaboration, direct connect and customer identity
Lesson coming
Sample questions
Try each one before opening the answer. Every option is explained, with the Microsoft documentation page that proves it.
Question 1 · choose 1
Contoso and Fabrikam are two Microsoft Entra tenants of the same company. Contoso employees must open Fabrikam's apps with their own Contoso accounts, and they must get the same default access as Fabrikam's employees rather than the limited privileges of guests. How should the Contoso users be represented in Fabrikam's directory?
AAs external guests
BAs external members
CAs internal members
DAs internal guests
Show the answer and why
AAs external guests
Incorrect
Guests authenticate externally, but their UserType of Guest gives them limited privileges by default.
BAs external members
Correct
They authenticate with an account external to Fabrikam but have a UserType of Member, which gives member-level access.
CAs internal members
Incorrect
Internal members have an account in the host tenant, so Contoso users would need separate Fabrikam credentials.
DAs internal guests
Incorrect
Internal guests have accounts created in the host tenant and are designated guests, a legacy scenario with limited privileges.
Microsoft Entra ID describes a user by how they authenticate (internal or external to the host tenant) and by the user type (member or guest). External members are common in organizations with several tenants: users sign in with their home tenant's account but are members in the other tenant, with member-level access.
An inventory lists the identities in a Microsoft Entra tenant: a container app that calls an API, a nightly automated process that writes to storage and a virtual machine that reads from Key Vault, none of them used by a person. Which category of Microsoft Entra identity do all three belong to?
ADevice identities
BExternal identities
CHybrid identities
DWorkload identities
Show the answer and why
ADevice identities
Incorrect
Device identities belong to hardware such as phones, laptops and IoT devices that people use to reach resources.
BExternal identities
Incorrect
External identities are people outside the organization, such as partners and customers, who bring their own accounts.
CHybrid identities
Incorrect
Hybrid identity is about users and groups synchronized between on-premises Active Directory and Microsoft Entra ID, not identities for software.
DWorkload identities
Correct
Software-based objects such as applications, services, virtual machines and containers get workload identities: applications, service principals and managed identities.
Microsoft Entra ID assigns identities to people (user identities), to physical devices (device identities) and to software-based objects such as applications, virtual machines, services and containers (workload identities). In Microsoft Entra, workload identities are applications, service principals and managed identities.
A new company has no on-premises Active Directory and never will. It buys Windows laptops for its staff, and employees sign in to them with their organizational Microsoft Entra accounts. Which device identity fits these laptops?
AMicrosoft Entra registered
BMicrosoft Entra hybrid joined
CA managed identity for each laptop
DMicrosoft Entra joined
Show the answer and why
AMicrosoft Entra registered
Incorrect
Registered devices support bring-your-own-device scenarios, where people reach resources from personal devices.
BMicrosoft Entra hybrid joined
Incorrect
Hybrid joined devices are joined to on-premises Active Directory as well, which this company doesn't have.
CA managed identity for each laptop
Incorrect
Managed identities are workload identities for Azure resources, not identities for hardware that people sign in to.
DMicrosoft Entra joined
Correct
Joined devices are joined to Microsoft Entra ID through an organizational account used to sign in, and are generally owned by the organization.
Microsoft Entra ID offers three device identities: registered for personal (BYOD) devices, joined for organization-owned devices that users sign in to with an organizational account, and hybrid joined for devices joined to both on-premises Active Directory and Microsoft Entra ID.
A retailer that has never used Azure Active Directory B2C is building a shopping app. Shoppers must sign up on their own or sign in with Google or Facebook, with personalized sign-in pages and account management. The architect's draft names Azure AD B2C as the identity service. What should the retailer use instead?
AMicrosoft Entra External ID in an external tenant
BAzure Active Directory B2C, bought as a new subscription
CMicrosoft Entra Verified ID
DB2B direct connect with each shopper's organization
Show the answer and why
AMicrosoft Entra External ID in an external tenant
Correct
External ID includes Microsoft's customer identity and access management solution, with self-service registration, social sign-in and account management.
BAzure Active Directory B2C, bought as a new subscription
Incorrect
Effective May 1, 2025, Azure AD B2C is no longer available to purchase for new customers.
CMicrosoft Entra Verified ID
Incorrect
Verified ID is a decentralized identity solution built on verifiable credentials; it isn't a sign-up and sign-in service for an app.
DB2B direct connect with each shopper's organization
Incorrect
B2B direct connect is a mutual trust between two Microsoft Entra organizations, used for Teams shared channels.
Azure AD B2C is no longer available to purchase for new customers. Microsoft Entra External ID includes Microsoft's customer identity and access management (CIAM) solution, built into Microsoft Entra ID: self-service registration, personalized sign-in experiences with single sign-on through social and enterprise identities, and customer account management.
AAn organization's own instance of Microsoft Entra ID and its security boundary
BA group of users and devices who share the same access permissions to resources
CAn Azure subscription that bills for Microsoft Entra licenses
DOne of several directories that an organization's tenant can contain
Show the answer and why
AAn organization's own instance of Microsoft Entra ID and its security boundary
Correct
A tenant holds one organization's users, groups, devices and app registrations and their policies, with a unique tenant ID and domain.
BA group of users and devices who share the same access permissions to resources
Incorrect
That describes a group in Microsoft Entra ID, which lives inside a tenant.
CAn Azure subscription that bills for Microsoft Entra licenses
Incorrect
A tenant is an instance of Microsoft Entra ID, not a billing subscription.
DOne of several directories that an organization's tenant can contain
Incorrect
A Microsoft Entra tenant consists of only one directory.
A Microsoft Entra tenant is an instance of Microsoft Entra ID in which information about a single organization resides, including users, groups, devices and application registrations, plus access and compliance policies. Each tenant has a unique tenant ID and a domain name, such as contoso.onmicrosoft.com, and consists of only one directory.
A small company on the free edition of Microsoft Entra ID wants a percentage that shows how closely its Microsoft Entra configuration follows Microsoft's best-practice recommendations, with improvement actions tailored to it. What can it use?
AIdentity secure score in Microsoft Entra ID
BCompliance score in Compliance Manager
CA Defender CSPM plan in Defender for Cloud
DRisky users report in ID Protection
Show the answer and why
AIdentity secure score in Microsoft Entra ID
Correct
Identity secure score is a percentage of alignment with Microsoft's recommendations, with tailored improvement actions, in all editions.
BCompliance score in Compliance Manager
Incorrect
Compliance score measures progress on regulatory improvement actions, not identity security configuration.
CA Defender CSPM plan in Defender for Cloud
Incorrect
Defender CSPM assesses cloud resources and is a paid plan, not an identity score.
DRisky users report in ID Protection
Incorrect
The risky users report lists accounts that may be compromised; it isn't a posture percentage.
Microsoft Entra ID includes an identity secure score, a percentage that indicates how aligned the organization is with Microsoft's best-practice security recommendations. Each improvement action is tailored to the configuration, and the score is available in all editions of Microsoft Entra ID.
A company has just subscribed to Microsoft 365. What does it need to do to start using Microsoft Entra ID?
ABuy Microsoft Entra ID P1 licenses for every user first
BNothing extra: Microsoft 365 subscriptions include access to it
CDeploy an on-premises Active Directory first and then synchronize it to the cloud
DOpen a separate Azure subscription to host the directory
Show the answer and why
ABuy Microsoft Entra ID P1 licenses for every user first
Incorrect
Premium licenses add capabilities, but basic access comes with the subscription.
BNothing extra: Microsoft 365 subscriptions include access to it
Correct
Subscribers to Azure, Microsoft 365 or Dynamics 365 automatically have Microsoft Entra ID and can upgrade to premium licenses.
CDeploy an on-premises Active Directory first and then synchronize it to the cloud
Incorrect
Microsoft Entra ID can be used as a standalone cloud service without on-premises Active Directory.
DOpen a separate Azure subscription to host the directory
Incorrect
Microsoft 365 subscribers already have access; no extra Azure subscription is required.
Subscribers to Azure services, Microsoft 365 or Dynamics 365 automatically have access to Microsoft Entra ID and can enhance it by upgrading to premium licenses. Microsoft Entra ID can be synchronized with an existing on-premises Active Directory or used as a standalone service.
A project team wants one group that gives its members a shared mailbox, calendar, files and a SharePoint site. Which group type fits, and what can its members be?
AA Microsoft 365 group, whose members can only be users
BA security group, whose members can only be users
CA Microsoft 365 group, whose members can include devices and service principals
DA security group, which also provides a shared mailbox and calendar
Show the answer and why
AA Microsoft 365 group, whose members can only be users
Correct
Microsoft 365 groups group users by collaboration needs and give access to shared mailbox, calendar, files and SharePoint.
BA security group, whose members can only be users
Incorrect
Security groups manage access to resources and can also contain devices, other groups, service principals and agent identities.
CA Microsoft 365 group, whose members can include devices and service principals
Incorrect
Microsoft 365 group members can only be users.
DA security group, which also provides a shared mailbox and calendar
Incorrect
Security groups are used for access to shared resources and policies, not for collaboration features like a shared mailbox.
Microsoft Entra ID has two group types. Security groups manage user and device access to shared resources and can contain users, devices, other groups, service principals and agent identities. Microsoft 365 groups group users by collaboration needs, giving them a shared mailbox, calendar, files and SharePoint sites; their members can only be users, including external users.