Examkin

Question

Difficulty: HardMicrosoft Entra ID Authentication and Conditional Access

A financial services firm is designing its hybrid identity infrastructure using Microsoft Entra ID. The firm has an on-premises Active Directory Domain Services (AD DS) environment and requires a secure, resilient access management design. Which Microsoft Entra ID authentication methods and Conditional Access features should you select to meet each business and security requirement?

  • Validate user authentication directly against on-premises Active Directory in real-time, ensuring that no password representations or hashes are stored in the cloud under any circumstances.Microsoft Entra Pass-through Authentication (PTA)
  • Ensure that users can authenticate to cloud resources using their domain credentials even during a complete WAN outage that isolates the on-premises domain controllers.Microsoft Entra Password Hash Synchronization (PHS)
  • Require external consultants accessing a specific project portal to re-authenticate every 8 hours and enforce access only from devices registered as compliant in Microsoft Intune.Conditional Access session controls and grant controls
  • Enforce multi-factor authentication (MFA) only when Entra ID detects anomalous behavior associated with the specific sign-in attempt, such as access from an unfamiliar IP address.Conditional Access sign-in risk policy

Answer

Validate on-premises in real-time matches Microsoft Entra Pass-through Authentication (PTA). Authenticate during WAN outage matches Microsoft Entra Password Hash Synchronization (PHS). Re-authenticate every 8 hours and compliant device matches Conditional Access session controls and grant controls. MFA on anomalous sign-in attempts matches Conditional Access sign-in risk policy.
Pass-through Authentication (PTA) routes user authentication requests directly to on-premises Active Directory domain controllers via local agents, keeping all password hashes out of Microsoft Entra ID. Password Hash Synchronization (PHS) syncs password hashes to the cloud, enabling cloud-based authentication even if the on-premises network or agents are down. Conditional Access session controls manage session lifetimes (like sign-in frequency), and grant controls enforce specific rules (like requiring compliant devices). Conditional Access sign-in risk policies detect session-specific anomalies, such as an unfamiliar IP address or location, during authentication.

Step-by-Step Solution

1
Analyze the real-time on-premises validation requirement.
Identify that Pass-through Authentication (PTA) passes the authentication request to local agents without storing any credentials in the cloud, fulfilling the zero-cloud-hash constraint.
To satisfy security policies that prohibit cloud storage of password hashes.
2
Evaluate the offline resilience requirement.
Identify that Password Hash Synchronization (PHS) synchronizes password hashes to the cloud, allowing Entra ID to authenticate users independently of the on-premises infrastructure status.
To ensure business continuity during an on-premises network or domain controller outage.
3
Determine the features needed for session limit and device compliance.
Determine that sign-in frequency (session controls) handles the 8-hour limit, and compliant device checks (grant controls) enforce the MDM requirement.
To combine session lifetime configuration with device-state verification using Conditional Access.
4
Assess the anomalous sign-in requirement.
Identify that sign-in risk policies evaluate anomalies for a specific authentication session (like atypical location), whereas user risk policies evaluate overall credential compromise likelihood.
To target session-specific anomalies dynamically during authentication.

Key Concept

Selecting hybrid authentication methods and designing Conditional Access policies based on security, availability, and session requirements.
Estimated Time:2m 30s
Rate this question

Topics

Microsoft Entra ID Authentication and Conditional Access