Examkin

Question

Difficulty: HardHybrid and Multi-Tenant Identity Solutions

NovaSpace Solutions has an on-premises Active Directory Domain Services (AD DS) forest named corp.novaspacesolutions.com containing 18,500 user accounts. The company is designing a hybrid identity solution to integrate their on-premises directory with a new Microsoft Entra ID tenant.

The solution must satisfy the following constraints:
- Passwords must be validated directly against on-premises Domain Controllers in real-time to comply with local financial regulatory policies that require local audit logging of all authentication requests.
- The authentication solution must be highly available and tolerate the failure of an individual on-premises authentication server.
- The design must minimize administrative overhead and avoid the deployment of complex federation infrastructure like Active Directory Federation Services (AD FS).
- Users must be able to use Microsoft Entra Self-Service Password Reset (SSPR) to reset their passwords, and these changes must update the on-premises AD DS.

Which hybrid identity solution should you recommend?

  1. A
    Active Directory Federation Services (AD FS) federated with Microsoft Entra ID, using a Web Application Proxy (WAP) farm for high availability
  2. B
    Microsoft Entra Connect Password Hash Synchronization (PHS) combined with Password Writeback, configuring high availability via staging mode servers
  3. Microsoft Entra Connect Pass-through Authentication (PTA) combined with Password Writeback, using multiple PTA agents installed on separate on-premises serversAnswer
  4. D
    Microsoft Entra Connect Cloud Sync with Pass-through Authentication (PTA) agents installed across multiple on-premises domain controllers

Answer

Microsoft Entra Connect Pass-through Authentication (PTA) combined with Password Writeback, using multiple PTA agents installed on separate on-premises servers
Pass-through Authentication (PTA) ensures that authentication requests are validated directly against on-premises Active Directory Domain Controllers in real-time, satisfying the regulatory auditing requirement. Installing multiple PTA agents on separate servers provides redundancy and high availability without the administrative overhead of deploying and maintaining Active Directory Federation Services (AD FS). Additionally, Microsoft Entra Connect supports Password Writeback to enable Self-Service Password Reset (SSPR) to update the on-premises directory.

Step-by-Step Solution

1
Analyze the authentication validation requirement.
Since the local regulatory policy requires password validation to happen directly against on-premises domain controllers in real-time, Password Hash Synchronization (PHS) is ruled out because it performs validation in the cloud.
Identifying that credential validation must happen locally narrows down the choices to Pass-through Authentication (PTA) or Active Directory Federation Services (AD FS).
2
Evaluate the administrative overhead and infrastructure constraints.
The scenario requires minimizing administrative overhead and explicitly states to avoid complex federation infrastructure such as AD FS.
This rules out AD FS as the primary solution, leaving PTA as the best candidate.
3
Address the high availability and business continuity requirements.
Pass-through Authentication can be made highly available by installing multiple lightweight PTA agents on separate on-premises servers.
This ensures that if one server hosting a PTA agent goes offline, authentication requests are automatically handled by other active agents, meeting the business continuity constraint.
4
Verify self-service and password writeback capabilities.
Microsoft Entra Connect Sync supports both PTA and Password Writeback, allowing users to use Self-Service Password Reset (SSPR) in the cloud with writeback to the on-premises AD DS.
This fulfills the final requirement of allowing cloud-based SSPR to write back to the on-premises directory.

Key Concept

Hybrid Identity Authentication Methods
Rate this question

Topics

Hybrid and Multi-Tenant Identity Solutions

More questions from this topic