Examkin

Question

Difficulty: MediumMicrosoft Entra ID Authentication and Conditional Access

A multinational retail corporation, Contoso Logistics, is designing a hybrid identity and security strategy to integrate its on-premises Active Directory Domain Services (AD DS) with Microsoft Entra ID. The design must satisfy the following requirements:
- Minimize the on-premises infrastructure footprint and management overhead.
- Allow users to authenticate to cloud services using their on-premises passwords, even if the on-premises network or domain controllers experience an outage.
- Enforce Multi-Factor Authentication (MFA) via Conditional Access for all user logins, while preventing tenant lockout in the event of an Azure MFA service disruption.
- Ensure that administrators can activate highly privileged roles only when needed, requiring approval and justification.

Which identity and security architecture should you recommend to meet these requirements?

  1. Configure Microsoft Entra Connect with Password Hash Synchronization (PHS). Create a Conditional Access policy requiring MFA, excluding a designated emergency access account group. Use Microsoft Entra Privileged Identity Management (PIM) to configure eligible role assignments.Answer
  2. B
    Configure Microsoft Entra Connect with Active Directory Federation Services (AD FS). Create a Conditional Access policy requiring MFA, excluding a designated emergency access account group. Use Microsoft Entra Privileged Identity Management (PIM) to configure eligible role assignments.
  3. C
    Configure Microsoft Entra Connect with Password Hash Synchronization (PHS). Create a Conditional Access policy requiring MFA for all users with no exclusions. Use Microsoft Entra Privileged Identity Management (PIM) to configure eligible role assignments.
  4. D
    Configure Microsoft Entra Connect with Password Hash Synchronization (PHS). Create a Conditional Access policy requiring MFA, excluding a designated emergency access account group. Use Microsoft Entra Privileged Identity Management (PIM) to configure active role assignments.

Answer

Configure Microsoft Entra Connect with Password Hash Synchronization (PHS), exclude a designated emergency access account group from the Conditional Access MFA policy, and use Microsoft Entra Privileged Identity Management (PIM) to configure eligible role assignments.
The correct architecture relies on Password Hash Synchronization (PHS), which requires the least on-premises infrastructure and ensures authentication is available even during on-premises outages. Excluding an emergency access group from the Multi-Factor Authentication (MFA) Conditional Access policy prevents tenant lockout if Azure MFA services fail. Using Microsoft Entra Privileged Identity Management (PIM) with eligible assignments ensures roles are active only when needed, requiring justification.

Step-by-Step Solution

1
Evaluate hybrid authentication options to minimize on-premises footprint and provide resilience during local outages.
Select Password Hash Synchronization (PHS) since it requires no extra on-premises infrastructure beyond Microsoft Entra Connect and allows cloud authentication even if on-premises domain controllers are unreachable.
Active Directory Federation Services (AD FS) requires significant on-premises infrastructure, making it unsuitable for minimizing the footprint.
2
Analyze Conditional Access policies for MFA and prevent lockout scenarios.
Require MFA for users but exclude emergency access (break-glass) accounts from the policy.
Excluding emergency access accounts ensures administrators can access the tenant if the Azure MFA service is experiencing an outage.
3
Determine the appropriate Privileged Identity Management (PIM) role assignment type to enforce just-in-time access.
Configure assignments as eligible rather than active.
Eligible assignments require users to request activation, provide justification, and undergo MFA/approval before receiving the privileges, unlike permanently active assignments.

Key Concept

Microsoft Entra ID Authentication methods, Conditional Access emergency exclusions, and Privileged Identity Management role configurations.
Estimated Time:1m 30s
Rate this question

Topics

Microsoft Entra ID Authentication and Conditional Access