Besides MFA and Conditional Access, the official skills outline for SC-900 Domain 2 (25–30%) lists "authentication methods," "password protection and management capabilities," "hybrid identity," and "types of identities, including workload identities" as separate items. The October 2026 revision spells out workload identities in the identity types item, and for hybrid identity Microsoft Entra Cloud Sync has replaced the Azure AD Connect of older materials as the recommended tool, so an outdated summary can easily mislead you.
This post goes through those items in order. It covers the differences between user, workload, and device identities; authentication methods and phishing-resistant authentication; password protection, which blocks weak passwords with banned password lists; self-service password reset (SSPR); and the synchronization tools and sign-in methods (PHS, PTA, federation) that connect on-premises and the cloud.
---
Identity Types in Entra ID: People, Devices, and Software
A company's access system does not manage only employee badges. Registered company cars and the delivery robots moving through the building need their own access records too. Microsoft Entra ID likewise splits the things it assigns identities to into three groups: people (user identities), physical devices (device identities), and software (workload identities).
User Identities
Users are classified by where they authenticate (internal or external) and by user type (member or guest). Employees are usually internal members, and a partner's employee who comes in with their own company account is an external guest. By default, guests have more limited privileges than members. B2B collaboration for inviting external users was covered in Microsoft Entra ID and Authentication.
Workload Identities
A workload identity is the identity that software such as an app, virtual machine, service, or container receives so it can authenticate to and access other resources.
| Type | Description | Credential management | |------|------|------| | Service principal | The app's identity, created in each tenant when the app is registered with Entra ID | Developers must protect secrets or certificates themselves | | Managed identity (system-assigned) | Turned on directly on an Azure resource such as a VM; deleted along with the resource | Managed automatically by Azure at no extra cost | | Managed identity (user-assigned) | Created as a standalone Azure resource and attached to multiple resources | Managed automatically by Azure; exists until you delete it |
The latest Microsoft Learn training also introduces Microsoft Entra Agent ID, a dedicated identity for AI agents. Each agent gets an accountable owner (a sponsor), and Conditional Access and lifecycle management are applied to it.
Device Identities
| Method | For | Example | |------|------|------| | Microsoft Entra registered | Personally owned devices (BYOD) | An employee reads work mail on a personal phone | | Microsoft Entra joined | Organization-owned devices, signed in with an organizational account | A company-issued laptop | | Microsoft Entra hybrid joined | Joined to both on-premises AD and Entra ID | Connecting existing domain PCs to the cloud |
Exam tip: "Access Azure resources without developers managing credentials" is a managed identity. "The identity is deleted when the VM is deleted" is system-assigned, and "several resources share the same identity" is user-assigned.
---
Authentication Methods: How You Prove Who You Are
Signing in with only a password is like guarding a house with a single key. Easy passwords are easy to crack, and hard ones get forgotten and stop work. Entra ID supports many methods that supplement or replace passwords altogether.
| Method | Main use | Notes | |------|------|------| | Password | Primary sign-in | Weakest when used alone | | SMS and voice call | Secondary method for MFA and SSPR (SMS can also be a primary sign-in) | Microsoft recommends moving to more modern methods | | OATH tokens | Secondary method for MFA and SSPR | An app or hardware device generates a one-time code every 30–60 seconds | | Microsoft Authenticator | Passwordless sign-in, push notifications with number matching, passkeys | Free app for iOS and Android | | Windows Hello for Business | Passwordless sign-in | A key tied to the device plus a PIN or biometrics | | Passkeys (FIDO2) | Passwordless sign-in | Public key cryptography; works only on the site where it was registered | | Certificate-based authentication (CBA) | Passwordless sign-in, MFA | Authenticates directly with X.509 certificates, no AD FS needed | | Temporary Access Pass (TAP) | Onboarding new hires, recovery after lost credentials | A time-limited passcode issued by an admin |
Phishing-Resistant Authentication
SMS and email one-time codes are vulnerable to remote phishing, where attackers trick users into handing over the code. Phishing-resistant methods use public key cryptography, and the credential is bound to the address (domain) of the site where it was registered, so it simply does not work on a fake site that looks identical to the real one.
Windows Hello for Business Platform Credential for macOS Synced passkeys and FIDO2 security keys Passkeys in Microsoft Authenticator Certificate-based authentication
Exam tip: When asked for the most phishing-resistant method, pick FIDO2 security keys, Windows Hello for Business, or certificate-based authentication. SMS is supported but rarely the right answer.
---
Password Protection: Stopping Weak Passwords from the Start
Just as a bank refuses "1234" or a birth date as a PIN, Microsoft Entra password protection rejects known weak passwords and their variants the moment a user changes or resets a password.
| Aspect | Global banned password list | Custom banned password list | |------|------|------| | Created by | Microsoft (from analysis of real password spray attacks) | Your organization | | Contents | Commonly used or leaked weak passwords | Company name, product names, headquarters location, internal abbreviations | | Setup | Applied automatically to all users; cannot be turned off | Admins add up to 1,000 terms |
A new password is evaluated against the two lists combined, in this order.
Normalization: converts to lowercase and reverses common substitutions, such as "@" to "a" and "$" to "s" Fuzzy matching: also rejects variants that differ from a banned term by one character Substring check: looks for the user's name and the tenant name Scoring: one point per banned term and one point per remaining character; it needs at least five points to pass
A password spray attack, rather than trying many passwords on one account, tries a few common passwords against many accounts to avoid lockouts. The global banned list is built from passwords actually used in such attacks. Smart lockout complements it by temporarily locking out only the attacker's attempts after repeated sign-in failures.
You can apply the same protection to on-premises AD DS. Install a proxy service on a domain-joined server and a DC agent on the domain controllers, and they download the cloud's banned lists and check on-premises password changes against the same rules. The domain controllers never need to talk to the internet directly, and no schema changes are required.
Exam tip: "Prohibit passwords that contain the company or product name" is the custom banned password list. The list that applies to every tenant with no configuration is the global banned password list.
---
SSPR: Resetting Passwords Without the Help Desk
SSPR (self-service password reset) lets users who forgot their password or got locked out change it themselves, without an admin or the help desk. To use it, the user needs an Entra ID license, an admin must turn SSPR on, and the user must have registered authentication methods in advance.
Available methods: Authenticator notifications, OATH tokens, SMS, voice call, email one-time passcode, security questions Security questions are scheduled to be retired from SSPR in March 2027 Admins set whether one or two methods are required to reset (admin accounts require two by default) For users synchronized from on-premises, turning on password writeback also applies the new password to on-premises AD
Exam tip: "Users reset their own passwords to cut help desk calls" is SSPR. Do not confuse it with password protection, which blocks weak passwords themselves.
---
Hybrid Identity: One Identity On-Premises and in the Cloud
If one headquarters badge also opens the branch office, employees are happier and administration is simpler. Hybrid identity provisions and synchronizes users and groups from on-premises Active Directory into Microsoft Entra ID, so the same identity works wherever an app runs.
| Sync tool | How it works | Status today | |------|------|------| | Microsoft Entra Cloud Sync | Installs only a lightweight provisioning agent; configuration lives in the cloud; multiple agents for high availability | The tool Microsoft recommends; new features land here | | Microsoft Entra Connect Sync | The earlier sync tool installed on an on-premises server | Being replaced by Cloud Sync |
When a synchronized user signs in to the cloud, there are three methods depending on where the password is checked.
| Sign-in method | Where the password is checked | Characteristics | |------|------|------| | Password hash synchronization (PHS) | Microsoft Entra ID (compared with the synced hash) | Simplest; cloud sign-in keeps working if on-premises is down; supports leaked credential detection | | Pass-through authentication (PTA) | AD DS, through an on-premises agent | Applies on-premises account policies immediately at sign-in | | Federation (AD FS) | An on-premises federation server | For advanced requirements that need separate server infrastructure |
!Hybrid sign-in methods differ in where the password is checked
Exam tip: "Keep sig