Examkin

Question

Difficulty: MediumHybrid and Multi-Tenant Identity Solutions

Lumina Healthcare has an on-premises Active Directory Domain Services (AD DS) forest named internal.luminahealth.org. You are designing a hybrid identity solution to integrate the on-premises AD DS with a new Microsoft Entra ID tenant.

The solution must meet the following requirements:
- Users must be able to authenticate to cloud services using their on-premises passwords.
- Users must be able to authenticate to cloud services even during a complete on-premises internet connectivity outage.
- Users must be allowed to reset their passwords using Microsoft Entra Self-Service Password Reset (SSPR), and password changes must immediately sync back to on-premises.
- Multi-factor authentication (MFA) must be enforced for all admin accounts, but you must prevent accidental tenant lockout if the primary MFA service experiences an outage.

Which identity design meets all of these requirements?

  1. A
    Configure federated identity using Active Directory Federation Services (AD FS) and enable Password Writeback. Implement a Conditional Access policy requiring MFA for all administrator roles, and exclude a designated emergency access account from this policy.
  2. B
    Configure Pass-through Authentication (PTA) with Microsoft Entra Connect and enable Password Writeback. Implement a Conditional Access policy requiring MFA for all administrator roles, and exclude a designated emergency access account from this policy.
  3. Configure Password Hash Synchronization (PHS) and enable Password Writeback in Microsoft Entra Connect. Implement a Conditional Access policy requiring MFA for all administrator roles, and exclude a designated emergency access account from this policy.Answer
  4. D
    Configure Password Hash Synchronization (PHS) and enable Password Writeback in Microsoft Entra Connect. Implement a Conditional Access policy requiring MFA for all administrator roles without any policy exclusions to ensure maximum security.

Answer

Configure Password Hash Synchronization (PHS) and enable Password Writeback in Microsoft Entra Connect, combined with a Conditional Access policy requiring MFA for administrative roles that excludes an emergency access account.
The correct option addresses all design constraints by utilizing Password Hash Synchronization (PHS) for resilient hybrid identity, enabling Password Writeback to support self-service password reset (SSPR), and excluding a break-glass account from the administrator multi-factor authentication (MFA) policy to prevent tenant lockout.

Step-by-Step Solution

1
Select the hybrid authentication sync method that maintains service availability during on-premises internet outages.
Password Hash Synchronization (PHS) is selected.
PHS validates credentials in the cloud directly, unlike AD FS or PTA which require real-time connectivity to the on-premises infrastructure.
2
Ensure password changes initiated in Microsoft Entra ID are replicated back to the on-premises Active Directory Domain Services.
Password Writeback is enabled.
This enables Microsoft Entra Self-Service Password Reset (SSPR) to write password updates back to the on-premises domain controllers immediately.
3
Apply a Conditional Access policy for administrative accounts with a lockout prevention mechanism.
Exclude a designated emergency access (break-glass) account from the MFA policy.
Failing to exclude an emergency account risks locking all admins out of the tenant if the MFA service is disrupted.

Key Concept

Selecting PHS for high availability hybrid identity authentication, enabling Password Writeback for SSPR, and configuring emergency access exclusions to prevent tenant lockout.
Rate this question

Topics

Hybrid and Multi-Tenant Identity Solutions

More questions from this topic