Examkin

Question

Difficulty: EasyHybrid and Multi-Tenant Identity Solutions

Aetherius Logistics has an on-premises Active Directory Domain Services (AD DS) forest and is deploying a new Microsoft Entra ID tenant. You are designing a hybrid identity solution. The company has the following requirements:
- Users must be able to authenticate to cloud services using their on-premises passwords.
- Users must be able to perform self-service password resets in Microsoft Entra ID, and the changes must sync back to the on-premises AD DS.
- To ensure business continuity, users must be able to sign in to cloud services even if the on-premises network link is temporarily down.
- On-premises infrastructure requirements must be kept to a minimum.

Which hybrid identity synchronization configuration should you recommend?

  1. Password Hash Synchronization (PHS) with Password Writeback enabledAnswer
  2. B
    Pass-through Authentication (PTA) with Password Writeback enabled
  3. C
    Active Directory Federation Services (AD FS) with Password Writeback enabled
  4. D
    Password Hash Synchronization (PHS) without Password Writeback enabled

Answer

Password Hash Synchronization (PHS) with Password Writeback enabled
Password Hash Synchronization (PHS) copies a hash of the user's password hash from on-premises AD DS to Microsoft Entra ID. This allows users to authenticate to cloud services even if the on-premises network link is down, satisfying the business continuity requirement. Enabling Password Writeback ensures that self-service password resets performed in the cloud are successfully written back to the on-premises directory. This combination also keeps the on-premises infrastructure to a minimum, requiring only the Microsoft Entra Connect sync tool.

Step-by-Step Solution

1
Evaluate the authentication and business continuity requirement.
Since cloud authentication must work even if the on-premises network link is down, the authentication processing must be independent of on-premises connectivity. This selects Password Hash Synchronization (PHS) and rules out Pass-through Authentication (PTA) and Active Directory Federation Services (AD FS).
Both PTA and AD FS validate credentials by forwarding requests to on-premises resources, making them dependent on the network link.
2
Evaluate the self-service capability requirement.
Self-service password resets (SSPR) initiated in Microsoft Entra ID must sync back to the on-premises Active Directory Domain Services (AD DS). This requires enabling Password Writeback.
Without Password Writeback, cloud-initiated password changes will not reflect in the on-premises directory.
3
Evaluate the infrastructure constraint.
Password Hash Synchronization (PHS) has the lowest infrastructure footprint compared to PTA and AD FS, as it only requires installing Microsoft Entra Connect or cloud sync agents without complex proxy or federation servers.
This satisfies the requirement to keep on-premises infrastructure to a minimum.

Key Concept

Selecting the appropriate hybrid identity synchronization method based on availability, self-service capability, and infrastructure constraints.
Rate this question

Topics

Hybrid and Multi-Tenant Identity Solutions

More questions from this topic