Examkin

Question

Difficulty: EasyMicrosoft Entra ID Authentication and Conditional Access

Tailspin Toys is designing a hybrid identity solution to integrate their on-premises Active Directory Domain Services (AD DS) with Microsoft Entra ID. The IT team wants to implement a single sign-on experience for users while minimizing on-premises infrastructure, maintenance overhead, and operational complexity. The company has no regulatory or compliance requirements that forbid storing password hashes in the cloud. Which hybrid authentication method should the company design to meet these requirements?

  1. Password Hash Synchronization (PHS) with Seamless Single Sign-OnAnswer
  2. B
    Active Directory Federation Services (AD FS)
  3. C
    Pass-through Authentication (PTA) with Seamless Single Sign-On
  4. D
    Privileged Identity Management (PIM) with JIT access

Answer

Password Hash Synchronization (PHS) with Seamless Single Sign-On
The correct answer is the option indicating Password Hash Synchronization (PHS) with Seamless Single Sign-On. Microsoft recommends PHS as the default, simplest, and most resilient hybrid identity authentication method. Since the company has no compliance restrictions against cloud storage of password hashes and wants to minimize on-premises infrastructure and administrative effort, PHS is the optimal choice.

Step-by-Step Solution

1
Analyze the requirements.
The requirement is to choose a hybrid identity authentication method that provides single sign-on (SSO), minimizes on-premises infrastructure, and reduces operational complexity. There are no restrictions on storing password hashes in the cloud.
This establishes the constraints and design goals for the hybrid identity architecture.
2
Evaluate the available hybrid authentication options based on complexity.
Password Hash Synchronization (PHS) requires the least infrastructure (only Entra Connect/Cloud Sync). Pass-through Authentication (PTA) requires on-premises agents. Active Directory Federation Services (AD FS) requires dedicated server pools and certificates.
Choosing the method with the lowest operational overhead is Microsoft's best practice when no compliance policies prevent storing password hashes in the cloud.
3
Select the correct option.
Password Hash Synchronization (PHS) with Seamless SSO meets all requirements with the lowest operational and infrastructure footprint.
PHS provides user sign-in to cloud services using their on-premises password without requiring any on-premises authentication infrastructure during sign-in.

Key Concept

Selecting the appropriate hybrid identity authentication method (PHS vs. PTA vs. AD FS) based on operational overhead, infrastructure requirements, and security compliance.
Rate this question

Topics

Microsoft Entra ID Authentication and Conditional Access