Examkin

Question

Difficulty: HardMicrosoft Entra ID Authentication and Conditional Access

A company named Aetheris Biotech is designing an identity and access management solution for a new Microsoft Entra ID tenant that will integrate with their on-premises Active Directory Domain Services (AD DS) domain. The design must satisfy the following requirements:

- Users must sign in using their on-premises credentials.
- Authentication must succeed even if the on-premises data centers experience a complete power outage.
- Privileged administrators must only activate their roles for a maximum of 4 hours when performing tasks, avoiding persistent active assignments.
- A Conditional Access policy requiring Multi-Factor Authentication (MFA) must apply to all administrators, but must prevent tenant lockout if the MFA service is unavailable.

Which solution should you recommend?

  1. A
    Configure Password Hash Synchronization (PHS) as the hybrid authentication method. Use Microsoft Entra Privileged Identity Management (PIM) to configure administrative role assignments as active with a 4-hour expiration. Create a Conditional Access policy requiring MFA for all administrators, and exclude an emergency access account from this policy.
  2. B
    Configure Pass-through Authentication (PTA) with Seamless Single Sign-On (SSO). Use Microsoft Entra Privileged Identity Management (PIM) to configure administrative role assignments as eligible. Create a Conditional Access policy requiring MFA for all administrators, and apply it to all administrator accounts without any exclusions.
  3. Configure Password Hash Synchronization (PHS) as the hybrid authentication method. Use Microsoft Entra Privileged Identity Management (PIM) to configure administrative role assignments as eligible. Create a Conditional Access policy requiring MFA for all administrators, and exclude an emergency access account from this policy.Answer
  4. D
    Configure Active Directory Federation Services (AD FS) as the hybrid identity solution. Use Microsoft Entra Privileged Identity Management (PIM) to configure administrative role assignments as eligible. Create a Conditional Access policy requiring MFA for all administrators, and exclude an emergency access account from this policy.

Answer

Configure Password Hash Synchronization (PHS) as the hybrid authentication method, configure administrative role assignments as eligible using Microsoft Entra Privileged Identity Management (PIM), and create a Conditional Access policy requiring MFA for all administrators while excluding an emergency access account.
The correct solution uses Password Hash Synchronization (PHS) because it copies a hash of the user's password to the cloud, allowing authentication to proceed even when the on-premises infrastructure is offline. By configuring roles as eligible in Microsoft Entra Privileged Identity Management (PIM), administrators must request and activate their roles on-demand (just-in-time), preventing persistent access. Finally, excluding an emergency access account from the MFA Conditional Access policy is a critical best practice that ensures tenant recovery and administration are possible if the MFA service is unavailable.

Step-by-Step Solution

1
Evaluate hybrid authentication options for offline resilience.
Identify Password Hash Synchronization (PHS) as the authentication method that allows authentication to continue in the cloud when the on-premises datacenter is completely offline.
Both Pass-through Authentication (PTA) and Active Directory Federation Services (AD FS) depend on active communication with on-premises servers or agents to process sign-ins.
2
Evaluate administrative role assignment strategy for least privilege.
Determine that administrative roles must be configured as eligible assignments in Privileged Identity Management (PIM).
Eligible assignments require administrators to explicitly activate their roles just-in-time, preventing persistent access, whereas active assignments grant immediate, continuous access.
3
Design the Conditional Access policy to prevent administrator lockout.
Exclude at least one emergency access account (break-glass account) from the Conditional Access policy requiring MFA.
Excluding an emergency access account ensures that administrators can still log in and manage the tenant if there is a wide-scale MFA service outage.

Key Concept

Designing resilient hybrid authentication and access governance using Password Hash Synchronization, PIM eligible assignments, and Conditional Access exclusions.
Estimated Time:2m 0s
Rate this question

Topics

Microsoft Entra ID Authentication and Conditional Access