Examkin

Question

Difficulty: HardHybrid and Multi-Tenant Identity Solutions

You are designing a hybrid identity and multi-tenant solution for a company named ZenithLogix. The company has an on-premises Active Directory Domain Services (AD DS) forest and a Microsoft Entra ID tenant. You need to select the appropriate identity feature or sync method to meet each of the following business and security requirements:

- Ensure that users can authenticate to cloud services even during an on-premises network or power outage.
- Enforce on-premises account restrictions (such as logon hours) in real-time for cloud authentication without deploying Active Directory Federation Services (AD FS).
- Allow guest users from a trusted partner company to log in to corporate resources using their own corporate Microsoft Entra tenant credentials.
- Enable users who reset their passwords in Microsoft Entra ID to have the changes immediately reflected in the on-premises AD DS.

Match each requirement on the left to the correct identity solution on the right.

  • Authentication must succeed during an on-premises network outage.Password Hash Synchronization (PHS)
  • On-premises logon hours must be enforced in real-time without AD FS.Pass-through Authentication (PTA)
  • External guest users must authenticate using their own Entra ID home tenant.Microsoft Entra B2B Collaboration
  • Password changes made via Microsoft Entra self-service password reset (SSPR) must sync back to on-premises AD DS.Self-Service Password Reset (SSPR) with Password Writeback

Answer

Match the requirements as follows: 'Authentication must succeed during an on-premises network outage' matches with 'Password Hash Synchronization (PHS)'; 'On-premises logon hours must be enforced in real-time without AD FS' matches with 'Pass-through Authentication (PTA)'; 'External guest users must authenticate using their own Entra ID home tenant' matches with 'Microsoft Entra B2B Collaboration'; and 'Password changes made via Microsoft Entra self-service password reset (SSPR) must sync back to on-premises AD DS' matches with 'Self-Service Password Reset (SSPR) with Password Writeback'.
The correct matches align with the availability, policy, external collaboration, and synchronization requirements of Microsoft Entra ID. Password Hash Synchronization (PHS) provides cloud-side resilience during on-premises outages. Pass-through Authentication (PTA) enables real-time verification against on-premises policies without deploying AD FS. Microsoft Entra B2B Collaboration handles partner user authentication natively, and SSPR with Password Writeback ensures credentials modified in the cloud sync back to AD DS.

Step-by-Step Solution

1
Analyze high availability requirements under network failure.
Identify that Password Hash Synchronization (PHS) stores password hashes in the cloud, allowing authentication to proceed even if the on-premises directory is unreachable.
PHS removes dependency on on-premises domain controllers during cloud sign-in.
2
Analyze real-time security policy enforcement requirements without federation.
Identify that Pass-through Authentication (PTA) validates credentials directly against on-premises AD DS via lightweight agents, enforcing account states and login hours in real-time.
PTA keeps credential validation on-premises but does not require complex AD FS federation infrastructure.
3
Analyze guest access requirement using external credentials.
Identify that Microsoft Entra B2B Collaboration allows inviting external users to use their own home identity provider.
B2B collaboration avoids the need to manage external user life cycles manually.
4
Analyze bi-directional password synchronization requirements.
Identify that Self-Service Password Reset (SSPR) with Password Writeback updates the on-premises AD DS when a user changes their password in the cloud.
SSPR writeback ensures password consistency between cloud and on-premises environments.

Key Concept

Selecting hybrid sync options (PHS, PTA) and multi-tenant/governance features (B2B, SSPR Writeback) based on authentication availability, policy enforcement, and synchronization constraints.
Rate this question

Topics

Hybrid and Multi-Tenant Identity Solutions

More questions from this topic