Enabling Passwordless Sign-in on Workgroup Devices
Your company has a Microsoft Entra tenant named contoso.com and a Microsoft 365 subscription. All users use Windows 10 devices to access Microsoft Office 365 apps. All the devices are in a workgroup. You plan to implement password less sign-in to contoso.com. You need to recommend changes to the infrastructure for the planned implementation. What should you include in the recommendation?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests the distinction between user identity (Azure AD) and device identity. The common trap is assuming the Authenticator app alone solves the problem, ignoring that it relies on a trusted device context which requires the device to be registered or joined.
This question explores the prerequisites for implementing passwordless authentication in a Microsoft 365 environment with Windows 10 devices currently in a workgroup. It establishes that device registration or joining is essential for supporting modern authentication methods like FIDO2 security keys.
Many candidates choose Option D (Microsoft Authenticator App) because it is the most visible passwordless method. However, they fail to realize that without the device being known to Azure AD (via Join or Registration), the trust relationship required for secure passwordless sign-in is incomplete or unsupported for enterprise scenarios.
Community Discussion (6 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option A is the correct recommendation because passwordless authentication methods, particularly FIDO2 security keys and Windows Hello for Business, require the device to be managed by the organization's identity provider. Since the devices are currently in a workgroup, they lack this integration. Joining the devices to the Microsoft Entra tenant (Azure AD) establishes the necessary trust relationship, allowing the device to participate in conditional access policies and support passwordless credentials.Why the Other Options Are Wrong
Option B (Application Proxy) is used for publishing on-premises applications, not for enabling client-side authentication. Option C (X.509 certificates) is a specific credential type but does not address the fundamental infrastructure gap of device management; you cannot effectively deploy enterprise certificates without a managed device lifecycle. Option D (Authenticator App) is a valid passwordless method, but as noted in community discussions, its effectiveness is limited if the device itself isn't recognized by the tenant, especially for features like 'Approve' prompts based on device compliance.Community Comment Notes
Community members highlight the importance of device state. One commenter asks, 'How do you plan to use Authenticator without joining the devices to the domain?', pointing out that device registration is a prerequisite for full functionality. Another notes that while Windows 10 doesn't have a dedicated 'Authenticator App' icon like mobile, the service exists, yet the core issue remains the unmanaged device status. The consensus supports A as the foundational step.Official Reference
Exam Strategy
Always check the device state before selecting an authentication method. If devices are unmanaged (workgroup), the first step is almost always to bring them under management (Join/Register) to enable advanced security features like passwordless and conditional access.
Frequently Asked Questions
Why can't I just use the Authenticator app without joining devices?
The Authenticator app works best when paired with a trusted device. Joining or registering the device ensures the system recognizes the hardware, enabling stronger security checks and Conditional Access policies.
Is X.509 certificate authentication better than joining devices?
No. Certificate-based auth is a credential type. To manage and deploy these certificates securely in an enterprise, you typically need the devices to be managed via Intune or joined to Entra ID.
Related Analysis
Practice All MS-102 Questions
Access 111 questions with complete answers and detailed explanations.
View Full MS-102 Practice Test →