A hybrid tenant already uses password hash synchronisation. Users on domain-joined corporate devices on the internal network must reach Microsoft 365 without typing their username and password again after their Windows sign-in, with no extra client software deployed. Which capability should the administrator enable to deliver this experience?
- AEnable pass-through authentication alongside password hash synchronisation, because switching the validation path automatically suppresses the cloud sign-in prompt for domain users.
- BEnable federation with Active Directory Federation Services, because redirecting authentication on-premises is the supported way to remove the prompt for internal devices.
- CEnable Microsoft Entra seamless single sign-on, because it uses Kerberos to silently authenticate domain-joined devices on the corporate network with no client software. Correct
- DDeploy a third-party single sign-on client to each corporate device so that the cached Windows credential is forwarded to Microsoft Entra ID during sign-in.
Why A is wrong: Pass-through authentication changes where the password is validated; it does not by itself silently sign domain-joined users in, so the prompt would still appear.
Why B is wrong: Federation can provide single sign-on but requires a federation server farm and infrastructure, which exceeds the no-extra-software constraint and is heavier than needed.
Why C is correct: Seamless single sign-on issues Kerberos tickets for the Microsoft Entra service so domain-joined devices on the corporate network are signed in silently, with no client agent required.
Why D is wrong: Deploying a client agent to every device contradicts the requirement for no extra client software and is not the native Microsoft approach for this scenario.