Enabling Passwordless Sign-in on Workgroup Devices

MS-102 By islever Editorial Last updated

Short answer

A Join all the devices to contoso.com to establish the necessary device trust for passwordless authentication.

Question

Your company has a Microsoft Entra tenant named contoso.com and a Microsoft 365 subscription. All users use Windows 10 devices to access Microsoft Office 365 apps. All the devices are in a workgroup. You plan to implement password less sign-in to contoso.com. You need to recommend changes to the infrastructure for the planned implementation. What should you include in the recommendation?
  1. Join all the devices to contoso.com. Correct Answer
  2. Deploy Microsoft Entra Application Proxy.
  3. Deploy X.509.3 certificates to all the users.
  4. Deploy the Microsoft Authenticator app.

Key Takeaways

The exam tests the distinction between user identity (Azure AD) and device identity. The common trap is assuming the Authenticator app alone solves the problem, ignoring that it relies on a trusted device context which requires the device to be registered or joined.

This question explores the prerequisites for implementing passwordless authentication in a Microsoft 365 environment with Windows 10 devices currently in a workgroup. It establishes that device registration or joining is essential for supporting modern authentication methods like FIDO2 security keys.

Common mistake: Many candidates choose Option D (Microsoft Authenticator App) because it is the most visible passwordless method. However, they fail to realize that without the device being known to Azure AD (via Join or Registration), the trust relationship required for secure passwordless sign-in is incomplete or unsupported for enterprise scenarios.

Expert Analysis

Why the Answer Is Correct

Option A is the correct recommendation because passwordless authentication methods, particularly FIDO2 security keys and Windows Hello for Business, require the device to be managed by the organization's identity provider. Since the devices are currently in a workgroup, they lack this integration. Joining the devices to the Microsoft Entra tenant (Azure AD) establishes the necessary trust relationship, allowing the device to participate in conditional access policies and support passwordless credentials.

Why the Other Options Are Wrong

Option B (Application Proxy) is used for publishing on-premises applications, not for enabling client-side authentication. Option C (X.509 certificates) is a specific credential type but does not address the fundamental infrastructure gap of device management; you cannot effectively deploy enterprise certificates without a managed device lifecycle. Option D (Authenticator App) is a valid passwordless method, but as noted in community discussions, its effectiveness is limited if the device itself isn't recognized by the tenant, especially for features like 'Approve' prompts based on device compliance.

Community Comment Notes

Community members highlight the importance of device state. One commenter asks, 'How do you plan to use Authenticator without joining the devices to the domain?', pointing out that device registration is a prerequisite for full functionality. Another notes that while Windows 10 doesn't have a dedicated 'Authenticator App' icon like mobile, the service exists, yet the core issue remains the unmanaged device status. The consensus supports A as the foundational step.

Exam Strategy

Always check the device state before selecting an authentication method. If devices are unmanaged (workgroup), the first step is almost always to bring them under management (Join/Register) to enable advanced security features like passwordless and conditional access.

Frequently Asked Questions

Why can't I just use the Authenticator app without joining devices?

The Authenticator app works best when paired with a trusted device. Joining or registering the device ensures the system recognizes the hardware, enabling stronger security checks and Conditional Access policies.

Is X.509 certificate authentication better than joining devices?

No. Certificate-based auth is a credential type. To manage and deploy these certificates securely in an enterprise, you typically need the devices to be managed via Intune or joined to Entra ID.

More MS-102 FAQ →

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. Nuance 👍 7 Answered A
    A. Join all the devices to contoso.com
  2. TonyTe0 👍 6
    Correct: D a public discussion thread on this question
  3. TonyManero 👍 3 Answered A
    The best recommendation to implement passwordless sign-in for your scenario is: A. Join all the devices to contoso.com Here's why the other options are not ideal: B. Deploy Microsoft Entra Application Proxy: This is not necessary for passwordless sign-in. Application Proxy publishes on-premises applications to Azure Active Directory (Azure AD) but doesn't directly affect passwordless login functionality. C. Deploy X.509.3 certificates to all the users: While certificates can be used for passwordless authentication, it's a more complex solution compared to Azure AD joined devices. D. Deploy the Microsoft Authenticator app: While the Microsoft Authenticator app can be used for multi-factor authentication (MFA) which can be part of a passwordless solution, it requires Azure AD joined devices to leverage Windows Hello for passwordless sign-in. Since your users are already using Windows 10 devices and you want passwordless sign-in, joining the devices to the Azure AD domain (contoso.com) allows them to leverage Windows Hello for passwordless login with features like fingerprint or facial recognition. This is a simpler and more efficient approach for your scenario.
  4. arsh807 👍 3 Answered A
    How do you plan to use Authenticator without joining the devices to the domain?
  5. APK1 👍 2
    Question clearly says "all users use windows 10" - Interestingly there is no Microsoft Authenticator App for Windows - So answer is A
Show 1 more comment
  1. GetEsn 👍 1 Answered D
    d

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Which passwordless method works on Windows, Android, and iOS?

S-grade

How Do You Monitor Mailbox Activities in Defender for Cloud Apps?

S-grade

Which components configure a Defender for Cloud Apps log collector?

S-grade

How to Configure a Custom Phishing Link in Attack Simulation Training?

S-grade

Practice All MS-102 Questions

Access 111 questions with complete answers and detailed explanations.

View Full MS-102 Practice Test →

← Back to MS-102 Study Guide