Examkin

Question

Difficulty: HardHybrid and Multi-Tenant Identity Solutions

Valerius Logistics is designing a hybrid identity solution to integrate their on-premises Active Directory Domain Services (AD DS) forest, which contains 22,000 users, with a new Microsoft Entra ID tenant.

The design must satisfy the following constraints:
- Authentication: Users must sign in to cloud applications using their on-premises credentials.
- Business Continuity: Cloud authentication must remain functional if the on-premises datacenter experiences an internet connectivity outage.
- Self-Service: Users must be able to reset their expired passwords via the Azure portal, and the changes must immediately update on-premises AD DS.
- Governance: To prevent administrator lockout during a tenant-wide Conditional Access policy deployment, at least two emergency access (break-glass) accounts must be created and excluded from all Multi-Factor Authentication (MFA) policies.

Which solution should you recommend to meet these requirements with the lowest administrative and infrastructure overhead?

  1. A
    Implement Microsoft Entra Connect with Pass-through Authentication (PTA) and enable Password Writeback. Create two cloud-only emergency access accounts and exclude them from all Conditional Access multi-factor authentication (MFA) policies.
  2. B
    Implement Active Directory Federation Services (AD FS) and enable Password Writeback. Create two cloud-only emergency access accounts and exclude them from all Conditional Access multi-factor authentication (MFA) policies.
  3. Implement Microsoft Entra Connect with Password Hash Synchronization (PHS) and enable Password Writeback. Create two cloud-only emergency access accounts and exclude them from all Conditional Access multi-factor authentication (MFA) policies.Answer
  4. D
    Implement Microsoft Entra Connect with Password Hash Synchronization (PHS) and enable Password Writeback. Create two cloud-only emergency access accounts and enforce multi-factor authentication (MFA) on all administrator accounts without exclusions.

Answer

Implement Microsoft Entra Connect with Password Hash Synchronization (PHS), enable Password Writeback, and exclude two cloud-only emergency access accounts from all Conditional Access multi-factor authentication policies.
The correct option implements Password Hash Synchronization (PHS) which satisfies the business continuity requirement by validating credentials in the cloud during an on-premises outage. Enabling Password Writeback supports SSPR updating the on-premises AD DS, and excluding the emergency access accounts from CA MFA policies prevents tenant lockout, all while requiring the lowest infrastructure overhead.

Step-by-Step Solution

1
Determine the optimal authentication and business continuity method.
Password Hash Synchronization (PHS) is selected.
Since cloud authentication must function during an on-premises network outage, authentication must occur entirely in the cloud. PHS stores a hash of the hash of user passwords in Microsoft Entra ID. Both Pass-through Authentication (PTA) and Active Directory Federation Services (AD FS) require real-time communication with the on-premises environment, which fails during an outage.
2
Identify self-service requirements.
Password Writeback must be enabled.
To support Self-Service Password Reset (SSPR) where changes are immediately reflected on-premises, Password Writeback must be configured in Microsoft Entra Connect.
3
Apply tenant governance and lockout prevention rules.
Two emergency access accounts must be excluded from Conditional Access MFA policies.
To prevent administrative lockout during tenant-wide policy updates or authentication outages, emergency (break-glass) accounts must be cloud-only and explicitly excluded from strict Conditional Access policies.
4
Select the option with the lowest overhead.
PHS with Password Writeback and policy exclusions.
PHS has the lowest infrastructure and administrative overhead because it does not require deploying or maintaining federation servers or highly available PTA agents.

Key Concept

Selecting the appropriate hybrid identity synchronization and authentication mechanism based on business continuity, self-service, and governance requirements.
Estimated Time:2m 0s
Rate this question

Topics

Hybrid and Multi-Tenant Identity Solutions

More questions from this topic