SC-100 - Design Security Operations, Identity, and Compliance Capabilities (27% of the exam) - Section 2.2

Design solutions for identity and access management across SaaS, PaaS, IaaS, hybrid, and multicloud resources.

Design identity and access management across SaaS, PaaS, IaaS, hybrid, and multicloud resources using Microsoft Entra ID, Conditional Access, and continuous access evaluation to enforce real-time policy. Distinguish when to extend trust via external identities (B2B) or decentralised identity, and harden Active Directory Domain Services (AD DS).

Microsoft Entra IDConditional Accesscontinuous access evaluationexternal identities (B2B) and decentralized identityActive Directory Domain Services (AD DS) hardeningsecrets, keys, and certificates management

Practice question for this objective

Free sampleDesign Security Operations, Identity, and Compliance Capabilitieshard

An organisation currently authenticates its hybrid users through Active Directory Federation Services and wants to move towards a Zero Trust target state where Microsoft Entra ID is the authentication authority, the on-premises federation servers are retired, and risk-based Conditional Access can evaluate every sign-in. Which authentication design best advances this requirement while keeping the existing on-premises directory in place?

AKeep Active Directory Federation Services as the authority but place a web application proxy in front of it and add claims rules that call Conditional Access during each federated sign-in.
BDeploy a third-party identity provider to broker authentication between users and Microsoft Entra ID so that sign-in decisions are centralised in that broker instead.
CRetain federation for existing users and enable cloud authentication only for newly created accounts so that both authentication paths run side by side indefinitely.
DMove sign-in to Microsoft Entra ID using cloud authentication with password hash synchronisation or pass-through authentication, then decommission the federation servers once cut over. Correct

Moving hybrid sign-in from federation to Microsoft Entra cloud authentication makes Microsoft Entra ID the authority and enables risk-based Conditional Access on every sign-in. Federated authentication leaves the sign-in decision on premises, outside the cloud signals that drive risk-based Conditional Access. Migrating to cloud authentication with password hash synchronisation or pass-through authentication moves the authority to Microsoft Entra ID, so every sign-in is evaluated against full risk and policy signals and the federation servers can be retired while directory synchronisation continues.

Why A is wrong: Adding a proxy and claims rules modernises the federation surface and seems pragmatic, but it keeps the on-premises servers as the authority and outside the cloud sign-in pipeline where the full risk signal lives, so it does not reach the intended Zero Trust state.

Why B is wrong: A third-party broker can centralise sign-in and is tempting if one is already licensed, but it moves the authority away from Microsoft Entra ID rather than to it and limits the native risk evaluation, so it contradicts the requirement to make Microsoft Entra ID the authority.

Why C is wrong: Running both paths in parallel feels like a safe incremental step, but it leaves the federation servers in production and a large population outside cloud sign-in evaluation, so the target of retiring federation and evaluating every sign-in is never actually met.

Why D is correct: Switching from federation to Microsoft Entra cloud authentication makes Microsoft Entra ID the authentication authority so risk-based Conditional Access can evaluate every sign-in, and it lets the federation servers be retired while the on-premises directory keeps syncing, which matches the target state precisely.

See more SC-100 practice questions, answers explained.

Exam traps in Design Security Operations, Identity, and Compliance Capabilities

Answers that look right on this material and are not. Each one is a distractor from a different question in the SC-100 bank for this domain.

Microsoft Entra Privileged Identity Management configured to make the application's administrative roles eligible rather than permanent, so privilege is activated just in time with approval and a fresh authentication challenge.
Why it is wrong: Privileged Identity Management governs standing administrative privilege through just-in-time elevation, a nearby identity-governance control, but it does not evaluate per-session user risk or enforce token changes mid-session, so it does not address the risk-adaptive access this stem requires.
Store the secrets and certificates in an Azure Storage account protected by a private endpoint and Microsoft Entra role-based access control on the container, rotating items with a scheduled function.
Why it is wrong: Private endpoints and storage roles add network and access control, but a storage account is not a secrets management service and provides no native certificate lifecycle, rotation, or per-secret audit trail, so it fails the governance requirement.
Apply Microsoft Entra Conditional Access policies that evaluate user risk, device health, and location on every sign-in, so risky sessions to the cloud management planes are blocked before any privileged action can be taken.
Why it is wrong: Conditional Access enforces the Zero Trust verify-explicitly principle at sign-in and is tempting because it constrains privileged access, but it gates the conditions of a session rather than measuring or reducing the permissions an identity holds, so the standing over-entitlement across the three clouds is left untouched.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.