Examkin

Question

Difficulty: HardHybrid and Multi-Tenant Identity Solutions

Aether Dynamics has an on-premises Active Directory Domain Services (AD DS) forest named corp.aetherdynamics.com and a Microsoft Entra ID tenant. You are designing a hybrid identity and secure access solution. The solution must meet the following requirements:

- Users must be able to sign in to cloud applications using their on-premises credentials, even if the on-premises datacenter suffers a complete network outage.
- Users must be able to reset their own passwords from the cloud portal, and the changes must update on-premises AD DS.
- On-premises infrastructure and administrative overhead must be kept to a minimum.
- Multi-factor authentication (MFA) must be enforced for all administrative roles, but the design must prevent administrator lockout in the event of a Microsoft Entra MFA service outage.
- Administrative roles must be managed using Privileged Identity Management (PIM) to ensure just-in-time (JIT) access.

Which hybrid identity and access configuration should you recommend?

  1. A
    Configure Microsoft Entra Connect with Pass-through Authentication (PTA) and password writeback. Create a Conditional Access policy requiring MFA for administrators, and exclude an emergency access account. Use Privileged Identity Management (PIM) to configure eligible role assignments.
  2. B
    Configure Microsoft Entra Connect with Password Hash Synchronization (PHS) and password writeback. Create a Conditional Access policy requiring MFA for administrators, but do not configure any exclusions to ensure maximum security. Use Privileged Identity Management (PIM) to configure eligible role assignments.
  3. Configure Microsoft Entra Connect with Password Hash Synchronization (PHS) and password writeback. Create a Conditional Access policy requiring MFA for administrators, and exclude a dedicated emergency access account. Use Privileged Identity Management (PIM) to configure eligible role assignments.Answer
  4. D
    Configure Microsoft Entra Connect with Password Hash Synchronization (PHS) and password writeback. Create a Conditional Access policy requiring MFA for administrators, and exclude an emergency access account. Use Privileged Identity Management (PIM) to configure permanently active role assignments for all administrators.

Answer

The configuration using Microsoft Entra Connect with Password Hash Synchronization, password writeback, a Conditional Access policy with an excluded emergency access account, and eligible PIM assignments.
The configuration using Microsoft Entra Connect with Password Hash Synchronization (PHS) ensures that user login requests can be authenticated directly by Microsoft Entra ID in the cloud, which satisfies the business continuity requirement during an on-premises network outage. Password writeback ensures cloud-initiated self-service password resets are successfully synced to on-premises AD DS. Excluding a break-glass account from the Conditional Access MFA policy prevents lockout during MFA outages, and eligible PIM assignments enforce just-in-time administrative access.

Step-by-Step Solution

1
Select the sync and authentication method that survives on-premises network outages and minimizes server overhead.
Password Hash Synchronization (PHS) is selected.
Unlike Pass-through Authentication (PTA) or Active Directory Federation Services (AD FS), PHS allows users to sign in using their synchronized credentials directly in the cloud without needing any active connection or on-premises servers to validate the password.
2
Select the password management option to allow cloud SSPR to write back to the local domain.
Password writeback is enabled.
This allows self-service password changes initiated in Microsoft Entra ID to update the on-premises AD DS instantly, preserving synchronization.
3
Ensure administrative accounts are secure from lockout during cloud MFA service outages.
Excluding a dedicated emergency access (break-glass) account from the MFA policy.
This guarantees that at least one highly privileged account can access the tenant even if Microsoft Entra MFA services are completely unavailable.
4
Configure the administrative access governance to meet JIT requirements.
Configure Privileged Identity Management (PIM) with eligible assignments.
PIM eligible assignments require users to request activation, fulfilling the JIT policy, whereas active assignments grant permanent access.

Key Concept

Designing hybrid identity and secure administration with high availability and least privilege governance in Azure.
Rate this question

Topics

Hybrid and Multi-Tenant Identity Solutions

More questions from this topic