Examkin

Question

Difficulty: HardHybrid and Multi-Tenant Identity Solutions

Aethelgard Manufacturing has an on-premises Active Directory Domain Services (AD DS) forest named internal.aethelgard.net with 14,000 users. The company has a primary Microsoft Entra ID tenant (aethelgard.com) and recently acquired a subsidiary that uses a separate Entra ID tenant (subsidiary.aethelgard.com). You are designing a hybrid identity and multi-tenant access solution to meet the following requirements:
1. On-premises users must be able to sign in to Microsoft 365 services.
2. The authentication method must support user logins even during a complete outage of the on-premises network or domain controllers.
3. Users must be able to reset their own passwords in the cloud, and these resets must be immediately written back to the on-premises AD DS.
4. You must enforce Multi-Factor Authentication (MFA) via Conditional Access for all standard users, but you must prevent a tenant lockout if the MFA service suffers an outage.
5. Users in the subsidiary tenant must be able to access shared line-of-business applications in the primary tenant using their existing credentials.

Which of the following designs should you recommend?

  1. Deploy Microsoft Entra Connect Sync with Password Hash Synchronization (PHS) and enable Password Writeback. Configure a Conditional Access policy enforcing MFA for all users, excluding a designated emergency access (break-glass) account. Configure Microsoft Entra B2B collaboration with cross-tenant access settings to allow subsidiary users to access primary tenant applications.Answer
  2. B
    Deploy Microsoft Entra Connect Sync with Active Directory Federation Services (AD FS) and federated authentication. Enable Password Writeback. Configure a Conditional Access policy enforcing MFA for all users, excluding a designated emergency access (break-glass) account. Configure Microsoft Entra B2B collaboration with cross-tenant access settings to allow subsidiary users to access primary tenant applications.
  3. C
    Deploy Microsoft Entra Connect Sync with Pass-through Authentication (PTA) and enable Password Writeback. Configure a Conditional Access policy enforcing MFA for all users, excluding a designated emergency access (break-glass) account. Configure Microsoft Entra B2B collaboration with cross-tenant access settings to allow subsidiary users to access primary tenant applications.
  4. D
    Deploy Microsoft Entra Connect Sync with Password Hash Synchronization (PHS) and enable Password Writeback. Configure a Conditional Access policy enforcing MFA for all users without exclusions. Configure Microsoft Entra B2B collaboration with cross-tenant access settings to allow subsidiary users to access primary tenant applications.

Answer

Deploy Microsoft Entra Connect Sync with Password Hash Synchronization (PHS) and enable Password Writeback. Configure a Conditional Access policy enforcing MFA for all users, excluding a designated emergency access (break-glass) account. Configure Microsoft Entra B2B collaboration with cross-tenant access settings to allow subsidiary users to access primary tenant applications.
The correct design uses Password Hash Synchronization (PHS) with Password Writeback, includes an emergency account exclusion in the Conditional Access MFA policy, and configures Microsoft Entra B2B collaboration. PHS meets the business continuity requirement because user credentials are validated directly in the cloud, ensuring sign-ins succeed even if the on-premises network is offline. Password Writeback ensures self-service password changes sync back to the local AD DS. Excluding emergency accounts from the CA policy avoids complete tenant lockout during MFA outages. Finally, Microsoft Entra B2B collaboration enables cross-tenant access without credential duplication.

Step-by-Step Solution

1
Select the hybrid authentication method that provides business continuity during local outages.
Password Hash Synchronization (PHS) is selected.
Unlike Pass-through Authentication (PTA) or Active Directory Federation Services (AD FS), PHS syncs a hash of the user's password to the cloud, enabling Entra ID to perform authentication locally in the cloud even if the on-premises network or domain controllers are down.
2
Enable self-service password reset with writeback to the on-premises directory.
Password Writeback is configured in Entra Connect.
This allows self-service password reset (SSPR) actions in the cloud to be synchronized immediately back to the on-premises Active Directory Domain Services.
3
Implement Conditional Access policies with tenant lockout prevention.
Conditional Access policy is created targeting all users for MFA, with an explicit exclusion for emergency access accounts.
Excluding designated break-glass accounts ensures that administrative access remains available in case of an MFA outage, satisfying the security/resilience constraint.
4
Establish secure cross-tenant collaboration for the subsidiary.
Microsoft Entra B2B collaboration and cross-tenant access settings are enabled.
This allows users from the subsidiary tenant to log in using their own credentials to access applications in the primary tenant.

Key Concept

Designing a resilient, secure hybrid identity architecture with multi-tenant collaboration using Password Hash Synchronization, Password Writeback, Conditional Access exclusions, and Entra B2B.
Rate this question

Topics

Hybrid and Multi-Tenant Identity Solutions

More questions from this topic