Examkin

Question

Difficulty: MediumHybrid and Multi-Tenant Identity Solutions

Apex Orion Logistics is designing a hybrid identity and multi-tenant access solution to integrate their on-premises Active Directory Domain Services (AD DS) forest, apex-orion.internal (containing 8,400 users), with a new Microsoft Entra ID tenant. The design must satisfy the following constraints:
- Authentication: Users must log in to cloud resources using their on-premises credentials. Under normal conditions, password validation must occur on-premises, and passwords or password hashes must not be stored in the cloud.
- Business Continuity: The authentication solution must support an automated standby mechanism that allows cloud logins to succeed even if the on-premises domain controllers or network connections become completely unavailable.
- Self-Service: Hybrid users must be able to reset their own passwords using self-service password reset (SSPR) in the cloud, and the changes must immediately update the on-premises AD DS.
- External Collaboration: Users from partner organizations who use their own Microsoft Entra ID tenants must be able to access internal resources securely, governed by granular inbound and outbound trust policies.

Match each business or technical requirement of the Apex Orion Logistics hybrid architecture to the most appropriate Microsoft Entra ID feature.

  • The primary authentication mechanism that validates credentials directly against on-premises domain controllers without storing passwords or password hashes in the cloud.Pass-Through Authentication (PTA)
  • The secondary authentication mechanism configured as a standby backup to ensure users can log in to cloud resources if the on-premises infrastructure goes offline.Password Hash Synchronization (PHS)
  • The synchronization feature required to write back password updates made via the Microsoft Entra ID self-service password reset (SSPR) portal to the on-premises AD DS.Password Writeback
  • The configuration used to define granular inbound and outbound trust policies for collaboration with partner Microsoft Entra ID tenants.Cross-Tenant Access Settings

Answer

The correct matches are: The primary authentication mechanism maps to Pass-Through Authentication (PTA); the standby backup authentication mechanism maps to Password Hash Synchronization (PHS); the SSPR writeback capability maps to Password Writeback; and the granular trust policy configuration maps to Cross-Tenant Access Settings.
The correct pairings match each requirement to the optimal hybrid feature: Pass-Through Authentication (PTA) validates passwords on-premises without cloud hash storage; Password Hash Synchronization (PHS) functions as a standby backup for high-availability; Password Writeback synchronizes cloud SSPR changes to on-premises AD DS; and Cross-Tenant Access Settings govern trust boundaries with partner tenants.

Step-by-Step Solution

1
Analyze the primary authentication constraint.
Since password validation must occur on-premises and hashes cannot be stored in the cloud under normal conditions, select Pass-Through Authentication (PTA) as the primary mechanism.
PTA routes authentication requests directly to on-premises agents without cloud storage of passwords or hashes.
2
Analyze the business continuity and failover requirements.
Select Password Hash Synchronization (PHS) as the standby backup.
PHS can be configured alongside PTA, allowing Microsoft Entra ID to fall back to cloud-based hash validation if on-premises agents or domain controllers become unavailable.
3
Analyze self-service and external collaboration constraints.
Select Password Writeback for SSPR synchronization, and Cross-Tenant Access Settings to define trust policies with partner tenants.
Password Writeback updates the local AD DS when users reset passwords in the cloud, while Cross-Tenant Access Settings control trust and access flow with external Entra ID tenants.

Key Concept

Designing a secure hybrid identity infrastructure with high-availability, self-service password capabilities, and multi-tenant access controls.
Rate this question

Topics

Hybrid and Multi-Tenant Identity Solutions

More questions from this topic