SC-900 Domain 1 (10–15%) carries little weight and is easy to skim, but the official skills outline lists "encryption and hashing," "identity providers," "directory services and Active Directory," and "federation" as separate items. The questions come in forms you can only answer with exact definitions, such as "Which transformation cannot be reversed?" or "What issues a token to a user who signed in successfully?"
This post covers those four concepts in one place. We go through symmetric and asymmetric encryption and digital signatures, encryption by data state and key management, hashing and salting, the tokens and protocols an identity provider uses, the difference between Active Directory Domain Services and Microsoft Entra ID, and the trust relationships behind federation.
---
Encryption: Readable Again Only with the Key
A locked box is useless to a thief who has no key. Encryption likewise turns data into a form that unauthorized people cannot read or use, and reading it again requires decrypting it with a secret key. Even if an attacker intercepts encrypted data, it is worthless without the key.
Symmetric vs Asymmetric Encryption
| Aspect | Symmetric encryption | Asymmetric encryption | |------|------|------| | Keys | One key for both encryption and decryption | A pair: a public key and a private key | | Speed | Fast; suited to large amounts of data | Relatively slow | | Weakness or strength | Hard to deliver the same key safely to the other party | The public key can be shared freely, which solves key distribution | | Typical use | Files on disk, database records | HTTPS, email encryption, digital signatures |
With asymmetric encryption, data encrypted with the public key can be decrypted only with the matching private key. Anyone can lock data with your public key and send it to you, but only you, holding the private key, can open it. The private key cannot be derived from the public key.
Digital Signatures
Using the asymmetric keys in the opposite direction gives you a digital signature. When the sender signs with their private key, anyone with the public key can confirm two things.
That the data really came from that sender (authenticity) That the content has not changed since it was signed (integrity)
Digital signatures are used to verify software downloads, authenticate email, and protect electronic documents and transactions.
Encryption by Data State
| State | Meaning | How it is protected | |------|------|------| | At rest | Data stored on disks, in databases, or in storage accounts | Encrypted so that stolen media cannot be read without the key | | In transit | Data moving across the internet, between services, or over private networks | HTTPS using TLS, VPN connections | | In use | Data loaded into memory and processed by the CPU | Protected execution environments (secure enclaves) in confidential computing |
Key Management
Encryption is only as secure as its keys. A leaked key defeats the purpose, so follow these principles.
Store keys separately from the data they protect Keep keys in dedicated tamper-resistant hardware (HSMs) Rotate keys regularly Control access to keys with strong authentication and least privilege
Azure Key Vault is a cloud key management service that manages keys, certificates, and secrets in one place.
Exam tip: "Locks and unlocks with the same key" is symmetric, "locks with the public key and unlocks with the private key" is asymmetric, and "signs with the private key and verifies with the public key" is a digital signature.
---
Hashing: A Fingerprint That Cannot Be Reversed
A fingerprint can confirm that a person is who they claim to be, but you cannot rebuild their face from the fingerprint alone. Hashing is a one-way transformation that uses an algorithm to turn any input into a fixed-length string (the hash).
| Property | Description | |------|------| | One-way | The original value cannot be recovered from the hash | | Deterministic | The same input with the same algorithm always gives the same hash | | Fixed length | Whether the input is one character or an entire book, the hash is the same length | | No key | Unlike encryption, it uses no key |
Password Storage and Salting
Systems store only the hash of a user's password, not the password itself. At sign-in, the password the user types is hashed again and compared with the stored value, so even if the whole database is stolen, the attacker gets only hashes.
Because hashes are deterministic, however, attackers can precompute the hashes of millions of common passwords in tables (rainbow tables) and look for matches. To stop this, each password gets a random value called a salt before it is hashed. Two users with the same password then end up with different hashes, and precomputed tables become useless.
| Aspect | Encryption | Hashing | |------|------|------| | Uses a key | Yes | No | | Recover the original | Yes, by decrypting with the key | No | | Output length | Varies with the input size | Always fixed | | Typical use | Hiding data for storage and transmission | Storing passwords, detecting tampering |
!Symmetric encryption, asymmetric encryption, and hashing at a glance
Exam tip: If the scenario only needs to check whether two values match, without ever knowing the original, the answer is hashing. Password hash synchronization in Microsoft Entra Connect likewise syncs a hash of the password to the cloud, not the actual password.
---
Identity Providers: Handling Sign-In on Everyone's Behalf
A hotel does not investigate its guests' identities itself; it trusts the passport a government issued. Modern authentication works the same way. Instead of every app managing its own user accounts and passwords, apps hand authentication over to a dedicated service, the identity provider (IdP).
An identity provider creates and manages identity information and offers authentication, authorization, and auditing to apps and services. When a user tries to sign in to an app, the app sends the user to the identity provider, which checks the credentials and then issues a security token. Because the app trusts the identity provider, it accepts the token as proof of a successful sign-in. Microsoft Entra ID is Microsoft's identity provider, and signing in with a Google or Facebook account works on the same principle.
Tokens and Claims
A token carries pieces of information (claims) such as the user's unique ID, name and email, roles and groups, and when it was issued and when it expires. Tokens expire after a set time, so a stolen token cannot be used forever.
| Token | Meaning | Used for | |------|------|------| | ID token | Proof that the user signed in successfully (authentication) | Lets the app know who the user is | | Access token | Permission to access a specific resource on the user's behalf (authorization) | Reading a calendar, calling an API, and so on |
Standard Protocols
| Protocol | Main role | Common use | |------|------|------| | OpenID Connect (OIDC) | Authentication | Modern cloud and mobile apps (built on top of OAuth 2.0) | | OAuth 2.0 | Authorization | Accessing protected resources with access tokens | | SAML | Authentication and federation | Enterprise apps, older apps, federation between organizations |
A central identity provider enables SSO, where one sign-in gets you into every app that trusts that identity provider, and disabling a single account in the identity provider cuts off access to all connected apps at once.
Exam tip: A frequent distinction is that OpenID Connect is used for authentication and OAuth 2.0 for authorization. If a question asks what issues the token, the answer is the identity provider.
---
Directory Services and Active Directory
Picture a single ledger that combines the company's employee roster with its building access list. A directory is a store of information about the users, devices, groups, policies, and applications on a network, and a directory service is the software that stores that information and answers "Who is this user, which groups do they belong to, and what can they access?"
Active Directory Domain Services (AD DS) is Microsoft's on-premises directory service, in use since Windows 2000 Server, and a server running AD DS is called a domain controller. Here is what AD DS lets you do.
Manage many on-premises systems with a single identity per user Control device settings across the organization with Group Policy Authenticate users to on-premises apps with Kerberos and NTLM Organize users and computers into organizational units (OUs)
AD DS, however, was designed around Windows PCs inside the corporate network. It does not natively support SaaS app authentication, iOS and Android management, modern protocols such as OAuth 2.0 and OpenID Connect, or remote access without a VPN.
| Aspect | AD DS | Microsoft Entra ID | |------|------|------| | Location | On-premises domain controllers | Cloud service run by Microsoft | | Protocols | Kerberos, NTLM, LDAP | OpenID Connect, OAuth 2.0, SAML | | Management | Group Policy, organizational units (OUs) | Conditional Access, app registrations, cloud policies | | Best fit | Windows devices and apps inside the corporate network | SaaS apps, mobile, remote work |
Entra ID is not "AD DS moved to the cloud." When you move older apps that need domain join, Group Policy, or Kerberos to the cloud, you use a separate managed domain service, Microsoft Entra Domain Services. Hybrid identity, which uses both environments together, continues in Entra Authentication Methods, Password Protection, and Hybrid Identity.
Exam tip: "Domain controller," "Group Policy," or "Kerberos" points to AD DS, while "SSO to SaaS apps" or "OAuth" points to Entra ID.
---
Federation: Trusting Another Organization's ID
Just as border control in another country accepts the passport your own country issued, federation sets up a trust relationship between different identity providers so