MD-102: Which WHfB Guidance Is Correct for a Cloud-Only Deployment?

Nicholas Peyton 60 Reputation points
2026-07-25T18:04:07.4566667+00:00

Cert: Microsoft 365 Certified: Endpoint Administrator Associate
Course: Prepare infrastructure for devices using Microsoft Intune and Microsoft Entra ID
Module: Administer device identity and authentication using Microsoft Entra ID
Relevant units: 4 & 7

Which guidance is correct?

Unit 4 states that cloud-only Windows Hello for Business deployments require no trust type. It describes key trust as an option for hybrid environments that already have PKI infrastructure and issue domain-controller certificates.

However, question 6 in Unit 7 describes a cloud-only environment with no on-premises Active Directory, yet marks “Deploy key trust with TPM 2.0 required” as correct? Every available answer requires either key trust or certificate trust.

Should the correct configuration instead be cloud-only Windows Hello for Business with TPM-backed credential storage required, but no trust type?

Unit 4 - https://learn.microsoft.com/en-gb/training/modules/device-identity-authentication-entra-id/04-authentication-methodCourse - Unit 4

Unit 7 - https://learn.microsoft.com/en-gb/training/modules/device-identity-authentication-entra-id/07-knowledge-check

Knowledge Check - Unit 7

I’d appreciate confirmation in case I’ve overlooked something. If this is an error, I’ll submit feedback through the course page, unless a moderator can raise it directly with the content team.

Thank you

Microsoft Security | Microsoft Entra | Microsoft Entra ID
Answer accepted by question author
Marcin Policht 108.3K Reputation points MVP Volunteer Moderator
2026-07-26T11:08:57.91+00:00

Yep - agreed - the guidance appears to be inconsistent.

Unit 4 correctly reflects the current Windows Hello for Business deployment guidance. In a cloud-only Microsoft Entra ID environment, Windows Hello for Business does not use a trust deployment model (Cloud Kerberos trust, key trust, or certificate trust). Those trust models exist to enable authentication with on-premises Active Directory resources in hybrid environments. If there is no on-premises Active Directory, there is no trust model to configure.

The knowledge check in Unit 7 describes a cloud-only organization with no on-premises Active Directory. The stated security requirement is hardware-backed credential storage, which is satisfied by requiring TPM 2.0. However, the answer "Deploy key trust with TPM 2.0 required" incorrectly introduces a hybrid trust model that is unnecessary in a cloud-only deployment.

The guidance should be about deploying Windows Hello for Business in cloud-only mode and require TPM-backed credential storage (TPM 2.0). No trust type should be specified because cloud-only deployments do not use key trust, certificate trust, or Cloud Kerberos trust.

The other two answers are also incorrect. Certificate trust requires an on-premises PKI and Active Directory infrastructure, which contradicts the scenario. The option to deploy key trust without TPM also conflicts with the stated security requirement for hardware-backed credential storage and ignores Microsoft's recommendation to require TPM whenever possible.

As written, the knowledge check appears to force a choice between trust models that are only applicable to hybrid deployments. The first answer is the "least incorrect" ;) because it includes the TPM requirement, but its reference to key trust contradicts the guidance presented in Unit 4 and Microsoft's Windows Hello for Business architecture.

A more accurate question would include an answer such as: "Deploy Windows Hello for Business in a cloud-only Microsoft Entra ID deployment and require TPM 2.0 for hardware-backed credential protection." That answer would align with both the scenario and the deployment guidance in Unit 4.

This forum is monitored by Microsoft staff - so hopefully they will account for your finding and fix the training content.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Was this answer helpful?

2 people found this answer helpful.

0 additional answers

Sort by: Newest
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.