Examkin

Question

Difficulty: HardHybrid and Multi-Tenant Identity Solutions

Vespera Financial Services has an on-premises Active Directory Domain Services (AD DS) forest named corp.vesperafin.com containing 14,200 user accounts. The company is designing a hybrid identity solution to integrate with a new Microsoft Entra ID tenant.

The solution must meet the following requirements:
- Users must sign in to cloud services using their on-premises passwords.
- Remote users must be able to authenticate to cloud services even during an extended internet outage at the corporate offices.
- Users on domain-joined devices within the corporate network must experience automatic sign-in without credential prompts or redirections to on-premises login pages.
- Users must be able to reset their passwords using Microsoft Entra Self-Service Password Reset (SSPR), with the changes synchronized on-premises in near real-time.
- On-premises infrastructure footprint and management overhead must be minimized.

Which hybrid identity and authentication configuration should you recommend?

  1. A
    Configure Pass-through Authentication (PTA) as the authentication method, enable Seamless Single Sign-On (Seamless SSO), and enable password writeback in Microsoft Entra Connect.
  2. Configure Password Hash Synchronization (PHS) as the authentication method, enable Seamless Single Sign-On (Seamless SSO), and enable password writeback in Microsoft Entra Connect.Answer
  3. C
    Deploy Active Directory Federation Services (AD FS) and Web Application Proxy (WAP) servers, configure federation in Microsoft Entra Connect, and enable password writeback.
  4. D
    Configure Password Hash Synchronization (PHS) as the authentication method, enable Seamless Single Sign-On (Seamless SSO), and configure Microsoft Entra self-service password reset (SSPR) without enabling password writeback.

Answer

Configure Password Hash Synchronization (PHS) as the authentication method, enable Seamless Single Sign-On (Seamless SSO), and enable password writeback in Microsoft Entra Connect.
The correct configuration uses Password Hash Synchronization (PHS) for authentication, which copies password hashes to Microsoft Entra ID. This enables cloud services to authenticate users directly, satisfying the business continuity requirement during on-premises outages. Combined with Seamless SSO, it allows domain-joined corporate devices to authenticate automatically without credential prompts. Enabling password writeback ensures that any password resets performed via Microsoft Entra SSPR are immediately synchronized back to the on-premises Active Directory Domain Services (AD DS).

Step-by-Step Solution

1
Evaluate the business continuity and outage resilience requirements.
Identify that authentication must occur in the cloud without depending on on-premises connectivity, which eliminates Pass-through Authentication (PTA) and Active Directory Federation Services (AD FS) as they require real-time on-premises validation.
Password Hash Synchronization (PHS) is the only method where Microsoft Entra ID performs authentication independently using cached hashes.
2
Address the single sign-on requirements and infrastructure overhead constraints.
Determine that Seamless SSO combined with PHS satisfies automatic sign-in for domain-joined corporate devices without the high management overhead of AD FS.
Seamless SSO utilizes a lightweight Kerberos-based mechanism, avoiding the need for dedicated AD FS and Web Application Proxy servers.
3
Verify self-service password reset requirements.
Confirm that password writeback must be enabled in Microsoft Entra Connect to ensure cloud-initiated resets sync back to the on-premises Active Directory Domain Services.
Without password writeback enabled, SSPR changes would remain cloud-only, causing credential mismatches with the on-premises environment.

Key Concept

Selecting the optimal hybrid identity authentication method (PHS vs. PTA vs. AD FS) based on business continuity, SSO requirements, and infrastructure complexity.
Estimated Time:2m 0s
Rate this question

Topics

Hybrid and Multi-Tenant Identity Solutions

More questions from this topic