Examkin

Question

Difficulty: MediumHybrid and Multi-Tenant Identity Solutions

Gideon Robotics is designing a hybrid identity and multi-tenant collaboration solution. The company has an on-premises Active Directory Domain Services (AD DS) forest containing 4,500 users. Gideon Robotics recently acquired AeroDynamics Inc., which uses a separate Microsoft Entra ID tenant.

You need to design an identity solution that meets the following requirements:
- Authentication: Synchronize on-premises users to the primary Gideon Robotics Microsoft Entra ID tenant. The method must have the lowest on-premises footprint, require no inbound network ports, and support the detection of leaked credentials in the cloud.
- Self-Service: Enable synchronized users to reset their own passwords in the cloud, with the changes automatically writing back to the on-premises Active Directory domain.
- Business Continuity: Authentication services must remain operational in the event of an outage of the on-premises network or domain controllers.
- Multi-Tenant Collaboration: Allow users from the AeroDynamics tenant to access shared applications in the Gideon Robotics tenant using their existing credentials, while ensuring their devices meet compliance policies configured in their home tenant.

Which two components should you include in the design to meet these requirements? (Select two.)

  1. Password Hash Synchronization (PHS) with Microsoft Entra Self-Service Password Reset (SSPR) writeback enabledAnswer
  2. Microsoft Entra B2B collaboration with cross-tenant access settings configured to trust compliant devicesAnswer
  3. C
    Active Directory Federation Services (AD FS) federated with Microsoft Entra ID and Web Application Proxy (WAP) servers
  4. D
    Pass-through Authentication (PTA) with Microsoft Entra Connect agents installed on-premises

Answer

Select Password Hash Synchronization (PHS) with SSPR writeback and Microsoft Entra B2B collaboration with cross-tenant access settings configured to trust compliant devices.
The correct solution uses Password Hash Synchronization (PHS) with SSPR writeback because PHS provides the lowest on-premises footprint, does not require inbound ports, and ensures business continuity by authenticating users in the cloud if the on-premises network is down. PHS also enables leaked credential detection in the cloud, while SSPR writeback satisfies the self-service capability. Additionally, Microsoft Entra B2B collaboration with cross-tenant access settings satisfies the multi-tenant collaboration requirements by allowing external users to authenticate using their home credentials while trusting their home tenant's device compliance status.

Step-by-Step Solution

1
Evaluate the authentication, on-premises footprint, and business continuity requirements.
Identify that Password Hash Synchronization (PHS) is the only hybrid sync method that requires zero inbound ports, has the lowest footprint, and allows authentication to proceed in the cloud during an on-premises network outage.
PHS copies password hashes to Microsoft Entra ID, allowing the cloud to handle login requests and check for leaked credentials natively.
2
Address the self-service password reset requirement.
Ensure Microsoft Entra Self-Service Password Reset (SSPR) with password writeback is enabled.
Password writeback ensures that password changes made by users in Microsoft Entra ID are written back to the on-premises Active Directory in real-time.
3
Address the multi-tenant collaboration and device compliance requirements.
Choose Microsoft Entra B2B collaboration and configure cross-tenant access settings to trust compliant devices from the AeroDynamics tenant.
Cross-tenant access settings allow the primary tenant to trust compliance states evaluated by the guest user's home tenant, preventing the need to register guest devices in the primary tenant.

Key Concept

Designing a secure, low-footprint hybrid identity and multi-tenant collaboration architecture using Password Hash Synchronization (PHS) and Microsoft Entra B2B cross-tenant trust settings.
Rate this question

Topics

Hybrid and Multi-Tenant Identity Solutions

More questions from this topic