Examkin

Question

Difficulty: MediumMicrosoft Entra ID Authentication and Conditional Access

NovaPeak Space Dynamics is designing an identity and access management strategy for its Microsoft Entra ID tenant. The tenant is synchronized with an on-premises Active Directory Domain Services (AD DS) domain. You need to design a solution that meets the following security requirements:

- Users must be able to sign in to cloud applications even if the on-premises network or domain controllers are unavailable.
- Administrators must not be locked out of the tenant in the event of an Azure Multi-Factor Authentication (MFA) service outage.

Which two configurations should you include in the design? (Select two.)

  1. Exclude a dedicated emergency access account from all Conditional Access policies that require multi-factor authenticationAnswer
  2. Configure Password Hash Synchronization (PHS) as the hybrid authentication methodAnswer
  3. C
    Deploy Active Directory Federation Services (AD FS) to handle all authentication requests
  4. D
    Assign the emergency access account a permanently active Global Administrator role in Microsoft Entra Privileged Identity Management (PIM)

Answer

Exclude a dedicated emergency access account from all Conditional Access policies that require multi-factor authentication, and configure Password Hash Synchronization (PHS) as the hybrid authentication method.
The correct configurations are using Password Hash Synchronization (PHS) and excluding emergency access accounts from Conditional Access policies. Password Hash Synchronization copies password hashes from on-premises Active Directory to Microsoft Entra ID, allowing users to sign in even if the on-premises infrastructure is unavailable. Excluding emergency access (break-glass) accounts from Conditional Access policies that require multi-factor authentication prevents administrative lockout if the Multi-Factor Authentication service experiences an outage.

Step-by-Step Solution

1
Evaluate the requirement for cloud authentication availability during on-premises downtime.
Password Hash Synchronization (PHS) is selected because it replicates password hashes to Microsoft Entra ID, allowing authentication directly in the cloud independent of on-premises domain controller availability.
On-premises identity providers like Active Directory Federation Services (AD FS) depend on active on-premises networks and domain controllers, which does not meet the resiliency requirement.
2
Evaluate the requirement to prevent administrator lockout during a multi-factor authentication (MFA) service outage.
A dedicated emergency access (break-glass) account is designed and excluded from all Conditional Access policies that require MFA.
Omitting exclusions for emergency access accounts risks permanent tenant lockout if Microsoft Entra MFA services are unreachable.
3
Ensure administrative role assignment alignment with security best practices.
Ensure the emergency access account is not configured with permanently active administrative roles in PIM, keeping assignments governed appropriately.
Permanent role assignment bypasses the security controls of Privileged Identity Management.

Key Concept

Designing resilient Microsoft Entra ID hybrid authentication and administrative access controls, including Password Hash Synchronization (PHS) for local outage resilience and emergency access account exclusions in Conditional Access policies to prevent lockout.
Rate this question

Topics

Microsoft Entra ID Authentication and Conditional Access