SC-300 - Plan and Implement Workload Identities (25% of the exam) - Section 3.2

Plan, implement, and monitor the integration of enterprise applications including on-premises and SaaS apps.

Integrate SaaS apps and on-premises web apps via Microsoft Entra Application Proxy into the enterprise application gallery and configure single sign-on methods including SAML, OIDC, and password-based SSO. Define application roles and monitor provisioning and sign-in activity for integrated apps.

enterprise application settingsMicrosoft Entra Application ProxySaaS app integrationsingle sign-on configurationapplication roles

Practice question for this objective

Free samplePlan and Implement Workload Identitiesmedium

An on-premises web application uses Integrated Windows Authentication against Active Directory and is published through Microsoft Entra Application Proxy with Microsoft Entra ID pre-authentication. After signing in to Microsoft Entra, users must be silently signed in to the back-end application using their Windows identity, without entering credentials again. Which single sign-on method should the administrator configure for the published application?

AConfigure SAML token-based single sign-on so the connector presents a signed assertion to the back-end and the application signs the user in using their Windows identity
BConfigure Kerberos constrained delegation so the connector obtains a Kerberos ticket on the user's behalf and the application signs them in using their Windows identity Correct
CConfigure header-based single sign-on so the connector injects identity headers and the application signs the user in using their Windows identity from those headers
DConfigure password-based single sign-on so the connector replays each user's stored credentials into the application and signs the user in using their Windows identity

Kerberos constrained delegation lets the Application Proxy connector obtain a Kerberos ticket for a pre-authenticated user, giving silent single sign-on to Integrated Windows Authentication apps. For an Integrated Windows Authentication back-end behind Application Proxy, Kerberos constrained delegation is the single sign-on method. After Microsoft Entra pre-authentication, the connector uses constrained delegation to obtain a Kerberos ticket on the user's behalf, so the application signs the user in with their Windows identity without a second prompt.

Why A is wrong: SAML single sign-on requires the back-end application to consume SAML assertions; an Integrated Windows Authentication app expects Kerberos, so a SAML assertion will not silently sign the user in.

Why B is correct: Integrated Windows Authentication back-ends accept Kerberos tickets, and Kerberos constrained delegation lets the Application Proxy connector obtain a ticket for the pre-authenticated user, delivering silent single sign-on with their Windows identity.

Why C is wrong: Header-based single sign-on suits applications that read identity from HTTP headers; an Integrated Windows Authentication back-end expects a Kerberos ticket rather than headers, so it does not provide silent sign-in here.

Why D is wrong: Password-based single sign-on replays credentials into an HTML login form and still depends on stored passwords; it does not perform Kerberos delegation for an Integrated Windows Authentication back-end.

See more SC-300 practice questions, answers explained.

Exam traps in Plan and Implement Workload Identities

Answers that look right on this material and are not. Each one is a distractor from a different question in the SC-300 bank for this domain.

SAML-based single sign-on, where Microsoft Entra ID issues a signed SAML assertion that the app validates so the user is signed in without typing credentials
Why it is wrong: SAML-based single sign-on requires the application to support SAML and consume assertions; this app offers no SAML, so this mode cannot be configured for it.
Register the IIS application in Microsoft Entra ID as an app registration and configure an OpenID Connect redirect URI so remote staff authenticate against the cloud endpoint directly.
Why it is wrong: An app registration creates an identity for an app that already speaks a modern protocol; the legacy IIS site uses Integrated Windows Authentication and is not internet-reachable, so registration alone does not publish it remotely.
Enable just-in-time SAML provisioning by mapping the user claims in the single sign-on configuration so the SaaS app creates each account the first time the user signs in.
Why it is wrong: Just-in-time provisioning can create an account at first sign-in, but it does not update or deactivate accounts when assignment is removed, so accounts would linger and manual cleanup would still be needed.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.