Examkin

Question

Difficulty: EasyHybrid and Multi-Tenant Identity Solutions

Your company, Litware Inc., plans to migrate workloads to Azure and must sync its on-premises Active Directory Domain Services (AD DS) to a Microsoft Entra ID tenant. The solution must meet the following requirements:
- Users must sign in to cloud services using their on-premises password.
- Authentication must remain operational even during a complete on-premises network outage.
- Users must be able to change their passwords in the cloud using self-service password reset (SSPR), and the changes must sync back to the on-premises AD DS environment.
- Administrative and infrastructure overhead must be minimized.

Which identity synchronization and authentication method should you recommend?

  1. Microsoft Entra Connect with Password Hash Synchronization (PHS) and password writeback enabledAnswer
  2. B
    Microsoft Entra Connect with Pass-through Authentication (PTA) and password writeback enabled
  3. C
    Active Directory Federation Services (AD FS) with password writeback enabled
  4. D
    Microsoft Entra Connect Cloud Sync with Pass-through Authentication (PTA)

Answer

Microsoft Entra Connect with Password Hash Synchronization (PHS) and password writeback enabled
The correct option is Password Hash Synchronization (PHS) with password writeback. PHS allows Microsoft Entra ID to perform authentication entirely in the cloud by using synchronized hashes of on-premises passwords. This satisfies the business continuity constraint, as cloud authentication remains fully functional even during an on-premises network outage. Password writeback ensures that password updates from Azure SSPR are synced back to the on-premises Active Directory Domain Services (AD DS). This approach also has the lowest administrative overhead since it requires no extra on-premises agent configurations or federated servers.

Step-by-Step Solution

1
Analyze the authentication requirement during on-premises network outages.
Identify that authentication must occur in the cloud without depending on on-premises domain controller availability. This eliminates Pass-through Authentication (PTA) and Active Directory Federation Services (AD FS) as standalone solutions.
Both PTA and AD FS validate credentials against the on-premises directory in real-time, meaning a network outage would prevent cloud logins.
2
Analyze the self-service and synchronization requirements.
Determine that Password Hash Synchronization (PHS) must be used alongside password writeback to enable self-service password reset (SSPR) writeback to the local Active Directory.
SSPR requires password writeback to be explicitly enabled in Microsoft Entra Connect to update on-premises AD DS.
3
Compare administrative overhead of the remaining options.
Confirm that PHS has the lowest administrative and infrastructure footprint compared to AD FS and PTA.
PHS does not require deploying on-premises agents or federated server farms to handle authentication traffic.

Key Concept

Selecting the appropriate hybrid identity authentication and synchronization method (PHS vs. PTA vs. AD FS) based on business continuity, compliance, and overhead constraints.
Estimated Time:45s
Rate this question

Topics

Hybrid and Multi-Tenant Identity Solutions

More questions from this topic