Examkin

Question

Difficulty: MediumHybrid and Multi-Tenant Identity Solutions

Vespera Industries has an on-premises Active Directory Domain Services (AD DS) forest containing 3,100 users. The company is planning to implement a hybrid identity solution that integrates the on-premises environment with a single Microsoft Entra ID tenant.

The solution must meet the following requirements:
- Users must be able to sign in to Azure cloud services using their on-premises credentials.
- Cloud authentication must remain functional even if the on-premises domain controllers or network connectivity on-premises become completely unavailable.
- On-premises infrastructure footprint and management overhead must be minimized.

Which hybrid identity authentication method should Vespera Industries implement?

  1. Password Hash Synchronization (PHS)Answer
  2. B
    Pass-through Authentication (PTA)
  3. C
    Active Directory Federation Services (AD FS)
  4. D
    Active Directory Domain Services (AD DS) domain controllers in Azure Virtual Machines

Answer

Password Hash Synchronization (PHS)
Password Hash Synchronization (PHS) meets all the requirements. It synchronizes a hash of the user's password hash from on-premises AD DS to Microsoft Entra ID, allowing authentication to occur entirely within Microsoft Entra ID. Because the credentials are stored in the cloud, user sign-in remains functional even if the on-premises domain controllers or network connectivity are completely unavailable. PHS requires the least infrastructure footprint, running as part of the core synchronization process without needing additional servers or agents for authentication.

Step-by-Step Solution

1
Analyze the business continuity and availability requirements for cloud authentication.
Identify that the solution must support authentication even if on-premises domain controllers or network connectivity are offline.
This eliminates authentication methods that require real-time communication with the on-premises environment (such as Pass-through Authentication and Active Directory Federation Services).
2
Analyze the infrastructure footprint and management overhead requirements.
Determine that the solution must minimize the deployment of extra components, agents, and virtual machines.
This eliminates deploying AD DS domain controllers in Azure VMs, as well as complex federation infrastructures like Active Directory Federation Services (AD FS).
3
Select the synchronization and authentication method that stores credentials in the cloud and requires the minimum setup.
Select Password Hash Synchronization (PHS) as it validates credentials in Microsoft Entra ID and has the lowest operational overhead.
PHS meets the offline capability requirement because Microsoft Entra ID processes the logins, and it meets the minimal footprint requirement because it uses the standard sync configuration.

Key Concept

Selecting the appropriate hybrid identity authentication method (PHS vs. PTA vs. AD FS) based on business continuity and infrastructure overhead constraints.
Rate this question

Topics

Hybrid and Multi-Tenant Identity Solutions

More questions from this topic