A water utility needs a cloud identity plane for municipal staff signing into Microsoft 365 and related cloud apps. Which service fits that role?
Select an answer to reveal the explanation.
Short Explanation
Entra ID is the city's ID badge system for the cloud — who you are when you open Microsoft 365 and other apps. You'll find Active Directory Domain Services, Microsoft Entra External ID, and Windows Hello for Business are real, but they're for on-premises resources, outside partners, and device sign-in — none of them is the cloud identity plane for staff itself. Badges first, then everything else plugs into that.
Full Explanation
Microsoft Entra ID is the cloud identity service for users accessing Microsoft 365 and related cloud apps. A water utility needs that identity plane for staff sign-in, group membership, and access decisions—not mail routing objects or file libraries pretending to be directories. Correctly identifying Entra ID as the municipal identity service is a core AB-900 Domain 1 skill.
Active Directory Domain Services fails as the identity service for Microsoft 365 and cloud app users because AD DS authenticates on-premises resources; cloud sign-in to Microsoft 365 and cloud apps is handled by Microsoft Entra ID, with AD DS objects synchronized into Entra ID rather than authenticating cloud apps directly. Microsoft Entra External ID fails as the identity service for users accessing Microsoft 365 and cloud apps because it is built to manage guest and partner identities from outside the organization, not the water utility's own staff directory—internal municipal staff sign in through the organization's primary Microsoft Entra ID tenant, not an external-identity service. Windows Hello for Business fails as the identity service for users accessing Microsoft 365 and cloud apps because it is a sign-in method—biometric or PIN-based authentication on a device—not a cloud directory; it still relies on an underlying identity in Microsoft Entra ID to authenticate against, it does not provision or host identities itself.
Exam caveat: Fundamentals items test service identification, not hybrid sync topology design. Active Directory Domain Services, Microsoft Entra External ID, and Windows Hello for Business are real identity-adjacent services—they simply are not the cloud identity plane Microsoft 365 authenticates against directly.
Operational check: Verify water-utility staff sign into Microsoft 365 against Entra ID identities, confirm app assignments and groups live in Entra, and document that Active Directory Domain Services, Microsoft Entra External ID, and Windows Hello for Business sit alongside—not in place of—that Entra ID identity service.
Prefer to study offline? Printable PDF study book + test engine ($7.50, unofficial). These questions stay free here.