Examkin

Question

Difficulty: MediumMicrosoft Entra ID Authentication and Conditional Access

Elysian Healthcare is designing a hybrid identity and access management solution for its Microsoft Entra ID tenant. The organization currently synchronizes user accounts from an on-premises Active Directory Domain Services (AD DS) domain.

The solution must meet the following requirements:
- Users must sign in to cloud services using their on-premises passwords.
- Users must be prompted for multi-factor authentication (MFA) when accessing any Azure management portal from an untrusted network.
- To prevent accidental tenant lockout during a service outage, a dedicated cloud-only emergency-access account must remain functional without MFA requirements.
- Administrative privileges for Azure resources must be granted dynamically on-demand for a limited time rather than being permanently assigned.
- On-premises infrastructure footprint and administrative overhead must be minimized.

Which of the following designs meets all of the requirements?

  1. Implement directory synchronization using Password Hash Synchronization (PHS). Create a Conditional Access policy requiring MFA for all users that excludes the emergency-access account. Configure Microsoft Entra Privileged Identity Management (PIM) with eligible role assignments.Answer
  2. B
    Implement directory synchronization by deploying on-premises Active Directory Federation Services (AD FS) and Web Application Proxy servers. Create a Conditional Access policy requiring MFA for all users that excludes the emergency-access account. Configure Microsoft Entra Privileged Identity Management (PIM) with eligible role assignments.
  3. C
    Implement directory synchronization using Password Hash Synchronization (PHS). Create a Conditional Access policy requiring MFA for all administrative users, including all global administrators and the emergency-access account. Configure Microsoft Entra Privileged Identity Management (PIM) with eligible role assignments.
  4. D
    Implement directory synchronization using Password Hash Synchronization (PHS). Create a Conditional Access policy requiring MFA for all users that excludes the emergency-access account. Configure Microsoft Entra Privileged Identity Management (PIM) with active role assignments.

Answer

Implement directory synchronization using Password Hash Synchronization (PHS). Create a Conditional Access policy requiring MFA for all users that excludes the emergency-access account. Configure Microsoft Entra Privileged Identity Management (PIM) with eligible role assignments.
The correct design utilizes Password Hash Synchronization (PHS) to synchronize on-premises credentials to Microsoft Entra ID with the lowest administrative overhead and server footprint. It implements a Conditional Access policy for MFA that excludes a cloud-only emergency-access account to prevent tenant lockout. Finally, it uses eligible role assignments in Microsoft Entra Privileged Identity Management (PIM) to ensure administrative privileges are requested and granted dynamically on-demand rather than remaining permanently assigned.

Step-by-Step Solution

1
Evaluate the hybrid identity synchronization requirement.
Password Hash Synchronization (PHS) is selected.
PHS allows users to sign in with their on-premises passwords while minimizing on-premises server footprint and administrative overhead compared to Active Directory Federation Services (AD FS).
2
Evaluate the emergency access and Conditional Access requirement.
Excluding the emergency-access account from the MFA Conditional Access policy.
This prevents administrative lockout in the event of an identity synchronization failure or a primary MFA service outage.
3
Evaluate the dynamic administrative access requirement.
Configure Microsoft Entra Privileged Identity Management (PIM) with eligible role assignments.
Eligible assignments require users to explicitly activate their roles on-demand for a limited duration, whereas active assignments make the access permanent.

Key Concept

Microsoft Entra ID Authentication, Conditional Access exclusions, and Privileged Identity Management (PIM) role assignments.
Rate this question

Topics

Microsoft Entra ID Authentication and Conditional Access