Examkin

Question

Difficulty: Very hardHybrid and Multi-Tenant Identity Solutions

Krypton Global Systems is designing a hybrid identity and multi-tenant access solution. The company has an on-premises Active Directory Domain Services (AD DS) forest named corp.kryptonglobal.com containing 28,500 user accounts. The company has a primary Microsoft Entra ID tenant named kryptonglobal.onmicrosoft.com and has recently acquired a subsidiary company that uses a separate tenant named kryptonsub.onmicrosoft.com.

You must design a solution that satisfies the following requirements:
- On-premises security policies, specifically logon hours restrictions, must be evaluated in real-time when users log in. The solution must minimize the on-premises infrastructure footprint and avoid deploying federation servers.
- Users must be able to perform self-service password resets (SSPR) that are immediately updated in the on-premises AD DS.
- In the event of a total WAN outage at the on-premises datacenters, administrators must have a pre-configured mechanism to quickly transition authentication to the cloud to maintain user access.
- Users in the subsidiary tenant must be allowed to access resources in the primary tenant without registering for Multi-Factor Authentication (MFA) in the primary tenant.
- All administrative access to the primary tenant must require MFA, but the design must guarantee that administrators can access the tenant even if the primary authentication or MFA service suffers a global outage.

Which of the following designs should you recommend?

  1. Deploy Microsoft Entra Connect with Pass-through Authentication (PTA) as the primary authentication method and enable Password Hash Synchronization (PHS) as a standby backup. Enable Password Writeback. In the primary tenant, configure cross-tenant access settings to trust MFA from the subsidiary tenant. Create a Conditional Access policy requiring MFA for all directory administrators, while excluding a dedicated cloud-only emergency access account.Answer
  2. B
    Deploy Microsoft Entra Connect with Active Directory Federation Services (AD FS) as the primary authentication method. Enable Password Writeback. In the primary tenant, configure cross-tenant access settings to trust MFA from the subsidiary tenant. Create a Conditional Access policy requiring MFA for all directory administrators, with no exclusions.
  3. C
    Deploy Microsoft Entra Connect with Password Hash Synchronization (PHS) as the sole authentication method. Enable Password Writeback. In the primary tenant, configure B2B collaboration and require subsidiary users to register for MFA in the primary tenant. Create a Conditional Access policy requiring MFA for all directory administrators, excluding a synchronized on-premises administrator account.
  4. D
    Deploy Microsoft Entra Connect with Pass-through Authentication (PTA) as the sole authentication method. Disable Password Hash Synchronization to prevent password hashes from being stored in the cloud. In the primary tenant, configure cross-tenant access settings to trust MFA from the subsidiary tenant. Create a Conditional Access policy requiring MFA for all directory administrators, while excluding a dedicated cloud-only emergency access account.

Answer

Deploy Microsoft Entra Connect with Pass-through Authentication (PTA) as the primary authentication method and enable Password Hash Synchronization (PHS) as a standby backup. Enable Password Writeback. In the primary tenant, configure cross-tenant access settings to trust MFA from the subsidiary tenant. Create a Conditional Access policy requiring MFA for all directory administrators, while excluding a dedicated cloud-only emergency access account.
The correct design recommends Pass-through Authentication (PTA) as the primary authentication method because it evaluates on-premises security policies (like logon hours) in real-time and has a low infrastructure footprint since it only requires lightweight agents on-premises rather than full AD FS federation servers. Enabling Password Hash Synchronization (PHS) alongside PTA serves as a standby backup authentication mechanism that can be quickly activated if on-premises connectivity fails. Enabling Password Writeback is required to allow self-service password resets (SSPR) to update the on-premises Active Directory. Configuring cross-tenant access settings to trust MFA from the subsidiary tenant allows external users to collaborate seamlessly without double MFA prompts. Finally, creating a Conditional Access policy that requires MFA for administrators while excluding a cloud-only emergency access account secures the tenant while preventing administrative lockout.

Step-by-Step Solution

1
Select the primary hybrid authentication method based on on-premises security policy constraints.
Pass-through Authentication (PTA) is selected because it evaluates local AD DS policies (such as logon hours) in real-time by routing requests directly to on-premises domain controllers, while avoiding the high infrastructure overhead of Active Directory Federation Services (AD FS).
This satisfies the real-time policy evaluation and low-footprint requirements.
2
Select the backup mechanism for business continuity during a total WAN outage.
Password Hash Synchronization (PHS) is enabled as a standby backup method.
If on-premises connectivity is lost, the PTA agents will be unreachable. Having password hashes already synchronized allows administrators to quickly switch the tenant sign-in method to PHS to restore authentication.
3
Configure multi-tenant collaboration settings to trust external claims.
In the primary tenant, cross-tenant access settings are configured to trust Multi-Factor Authentication (MFA) from the subsidiary tenant.
This allows subsidiary users to access primary tenant resources using their existing credentials and satisfies the requirement to avoid duplicate MFA registration.
4
Design administrative security policy and exclude emergency access accounts.
A Conditional Access policy is configured to require MFA for all administrators, explicitly excluding a dedicated cloud-only emergency access (break-glass) account.
This ensures compliance with administrative MFA requirements while preventing a total lockout if MFA services or primary authentication methods fail.

Key Concept

Designing hybrid identity and multi-tenant solutions that balance real-time on-premises policy enforcement, high availability through failover sync options, cross-tenant trust settings, and emergency access recovery.
Estimated Time:3m 0s
Rate this question

Topics

Hybrid and Multi-Tenant Identity Solutions

More questions from this topic