CloudScale Industries is designing a hybrid identity solution to synchronize on-premises Active Directory Domain Services (AD DS) user accounts to a single Microsoft Entra ID tenant.
The solution must meet the following requirements:
- Users must be able to sign in to Azure resources using their on-premises passwords.
- Users must be able to authenticate successfully even if the on-premises network or domain controllers are temporarily offline.
- Users must have the ability to reset their passwords in the cloud, and the changes must immediately update their passwords on-premises.
Which two features or configurations should you recommend? (Select two.)
- Password Hash Synchronization (PHS)Answer
- Password writebackAnswer
- CActive Directory Federation Services (AD FS)
- DDirect assignment of Azure RBAC roles to individual synchronized user accounts
- EPermanently active Entra ID roles assigned to administrative accounts in Privileged Identity Management (PIM)
Answer
To meet the requirements, you should configure Password Hash Synchronization (PHS) to allow offline cloud authentication and enable Password writeback to support updating on-premises passwords from the cloud.
Password Hash Synchronization (PHS) satisfies the requirement to authenticate users in the cloud using on-premises passwords while maintaining sign-in capability during on-premises network or domain controller outages. Password writeback enables self-service password reset (SSPR) updates in Microsoft Entra ID to sync back to the on-premises Active Directory.
Step-by-Step Solution
Key Concept
Hybrid identity synchronization and authentication methods with Microsoft Entra Connect