Examkin

Question

Difficulty: MediumMicrosoft Entra ID Authentication and Conditional Access

Altus Manufacturing is designing an identity security strategy for its Microsoft Entra ID tenant. The organization currently synchronizes its on-premises Active Directory Domain Services (AD DS) user accounts to Microsoft Entra ID. The design team must satisfy the following requirements:
1. Enforce multi-factor authentication (MFA) for all users when accessing cloud applications, utilizing Conditional Access.
2. Require administrators to activate the Global Administrator role only when performing administrative tasks, ensuring access is temporary and audited.
3. Prevent administrative lockout if the tenant experiences an MFA service outage or if a policy is misconfigured.
4. Minimize operational and infrastructure overhead for the hybrid identity architecture.

Which configuration should you recommend to meet these requirements?

  1. Configure Password Hash Synchronization (PHS) for user authentication. Configure Microsoft Entra Privileged Identity Management (PIM) with eligible assignments for the Global Administrator role. Create a Conditional Access policy requiring MFA for all users, but exclude a dedicated, cloud-only emergency access account.Answer
  2. B
    Configure Password Hash Synchronization (PHS) for user authentication. Configure Microsoft Entra Privileged Identity Management (PIM) with eligible assignments for the Global Administrator role. Create a Conditional Access policy requiring MFA for all users, including all Global Administrator and emergency access accounts to ensure comprehensive protection.
  3. C
    Configure Password Hash Synchronization (PHS) for user authentication. Configure Microsoft Entra Privileged Identity Management (PIM) with active assignments for the Global Administrator role. Create a Conditional Access policy requiring MFA for all users, and exclude a dedicated, cloud-only emergency access account from the policy.
  4. D
    Deploy Active Directory Federation Services (AD FS) on-premises to handle user authentication. Configure Microsoft Entra Privileged Identity Management (PIM) with eligible assignments for the Global Administrator role. Create a Conditional Access policy requiring MFA for all users, and exclude a dedicated, cloud-only emergency access account from the policy.

Answer

Configure Password Hash Synchronization (PHS) for user authentication, configure Microsoft Entra Privileged Identity Management (PIM) with eligible assignments for the Global Administrator role, and create a Conditional Access policy requiring MFA for all users while excluding a dedicated, cloud-only emergency access account.
The configuration using Password Hash Synchronization (PHS) provides the lowest overhead for hybrid identity compared to Active Directory Federation Services (AD FS). Using Microsoft Entra Privileged Identity Management (PIM) with eligible role assignments enables just-in-time (JIT) access for Global Administrators. Excluding a dedicated, cloud-only emergency access account from the Conditional Access policy prevents tenant lockout in case of MFA service outages or misconfigurations.

Step-by-Step Solution

1
Evaluate the hybrid identity authentication method based on operational overhead.
Select Password Hash Synchronization (PHS) as it requires no additional on-premises servers or federation infrastructure, unlike Active Directory Federation Services (AD FS).
To satisfy the requirement of minimizing operational and infrastructure overhead.
2
Determine the appropriate Privileged Identity Management (PIM) role assignment type.
Configure the Global Administrator role assignments as eligible rather than active.
To enforce Just-In-Time (JIT) activation and ensure users do not have standing administrative privileges.
3
Design the Conditional Access policy and lockout prevention strategy.
Enforce MFA for all users, but explicitly exclude a dedicated, cloud-only emergency access account from the policy.
To prevent tenant lockout if standard MFA mechanisms are unavailable or if a policy misconfiguration occurs.

Key Concept

Designing secure Entra ID access with PIM, PHS, and Conditional Access exclusion policies for emergency accounts.
Rate this question

Topics

Microsoft Entra ID Authentication and Conditional Access