Examkin

Question

Difficulty: MediumHybrid and Multi-Tenant Identity Solutions

Solaris Heavy Industries is designing a hybrid identity and collaboration solution. The company has an on-premises Active Directory Domain Services (AD DS) forest named solaris.local that contains 12,500 user accounts. They recently acquired a subsidiary that uses an independent Microsoft Entra ID tenant named aurora-aviation.onmicrosoft.com.

You need to design a solution that meets the following requirements:
- Users in solaris.local must be synchronized to the primary Microsoft Entra tenant (solaris-heavy.onmicrosoft.com) and must be able to authenticate to Azure resources even if the on-premises network link to Azure is temporarily offline.
- On-premises users must be able to change their passwords using Microsoft Entra Self-Service Password Reset (SSPR), and the changes must update the on-premises AD DS immediately.
- Guest users from aurora-aviation.onmicrosoft.com must be allowed to access shared resources in solaris-heavy.onmicrosoft.com securely.
- You must minimize administrative overhead and avoid hosting extra on-premises federation servers.

Which two components should you include in the hybrid identity design? (Select two.)

  1. Microsoft Entra Connect Sync with Password Hash Synchronization (PHS) and password writeback enabledAnswer
  2. Microsoft Entra B2B collaboration with cross-tenant access settings configured to allow guest accessAnswer
  3. C
    Microsoft Entra Connect Sync with Pass-through Authentication (PTA) and password writeback enabled
  4. D
    Active Directory Federation Services (AD FS) with active-passive federated trust servers

Answer

The hybrid identity design must include Microsoft Entra Connect Sync with Password Hash Synchronization (PHS) and password writeback enabled, and Microsoft Entra B2B collaboration with cross-tenant access settings configured to allow guest access.
Microsoft Entra Connect Sync with Password Hash Synchronization (PHS) and password writeback enabled satisfies the authentication requirement under offline conditions and allows on-premises password updates via SSPR. Microsoft Entra B2B collaboration with cross-tenant access settings securely incorporates users from the subsidiary's tenant with minimal administrative effort.

Step-by-Step Solution

1
Evaluate hybrid authentication methods against the offline resilience requirement.
Password Hash Synchronization (PHS) is selected because authentication is processed entirely in the cloud, removing dependency on the on-premises link.
Pass-through Authentication (PTA) and Active Directory Federation Services (AD FS) require active, real-time connectivity to on-premises servers to authenticate users, failing the business continuity constraint.
2
Identify self-service password modification requirements.
Password writeback must be enabled on the Microsoft Entra Connect sync server.
This allows self-service password reset (SSPR) actions performed in the cloud to be written back to the on-premises Active Directory Domain Services.
3
Select the secure collaboration method with the lowest administrative overhead.
Microsoft Entra B2B collaboration with cross-tenant access settings is chosen.
This permits secure, multi-tenant collaboration between the primary tenant and the newly acquired subsidiary's tenant without configuring complex external federation structures.

Key Concept

Designing a resilient, low-overhead hybrid identity solution that combines local Active Directory synchronization, password writeback, and multi-tenant B2B collaboration settings.
Rate this question

Topics

Hybrid and Multi-Tenant Identity Solutions

More questions from this topic