Exam MS-100 topic 4 question 47 discussion

https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso-quick-start D is correct

I thought C but hey, I'm a flexible guy you know!

D is correct

"You implement password hash synchronization and Azure Active Directory (Azure AD) Seamless Single Sign-On (Seamless SSO)." This tells me we've already done everything we need to do with syncing things to Azure. So if there's a remaining obstacle, it can only be D.

https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso-quick-start#why-do-you-need-to-modify-users-intranet-zone-settings Why do you need to modify users' Intranet zone settings? By default, the browser automatically calculates the correct zone, either Internet or Intranet, from a specific URL. For example, http://contoso/ maps to the Intranet zone, whereas http://intranet.contoso.com/ maps to the Internet zone (because the URL contains a period). Browsers will not send Kerberos tickets to a cloud endpoint, like the Azure AD URL, unless you explicitly add the URL to the browser's Intranet zone.

it clearly states that device doesn't need to be Azure AD joined, but should be AD joined, so I would go with D

C also seems feasible.

Answer Can be C or D, IMHO, Better answer C SSO via PRT works once devices are registered with Azure AD for hybrid Azure AD joined, Azure AD joined or personal registered devices via Add Work or School Account. For more information on how SSO works with Windows 10 using PRT https://blog.matrixpost.net/azure-active-directory-seamless-single-sign-on-and-primary-refresh-token-prt/

This might be true. but C is also right. For Windows 10, the recommendation is to use Azure AD Join for the optimal single sign-on experience with Azure AD.