Examkin

Question

Difficulty: MediumHybrid and Multi-Tenant Identity Solutions

Novasphere Solutions has an on-premises Active Directory Domain Services (AD DS) forest named novasphere.local with 3,200 user accounts. You are designing a hybrid identity solution to integrate the on-premises directory with a new Microsoft Entra ID tenant. The solution must meet the following requirements:
- Users must be able to sign in to Azure resources using their on-premises credentials.
- In the event of an on-premises datacenter or internet connectivity outage, users must still be able to authenticate to cloud services.
- Users must have the ability to reset their own passwords in the cloud, and these changes must immediately reflect in the on-premises directory.
- The administrative overhead of the identity infrastructure must be minimized.

Which hybrid identity synchronization and configuration strategy should you recommend?

  1. Password Hash Synchronization (PHS) with Microsoft Entra Connect and password writeback enabledAnswer
  2. B
    Pass-through Authentication (PTA) with Microsoft Entra Connect and password writeback enabled
  3. C
    Active Directory Federation Services (AD FS) federation with Microsoft Entra Connect
  4. D
    Password Hash Synchronization (PHS) with Microsoft Entra Connect and password writeback disabled

Answer

Password Hash Synchronization (PHS) with Microsoft Entra Connect and password writeback enabled
The correct strategy is to use Password Hash Synchronization (PHS) with password writeback enabled. PHS copies password hashes to Microsoft Entra ID, allowing authentication to occur completely in the cloud. This fulfills the business continuity requirement during an on-premises outage and minimizes administrative overhead. Enabling password writeback allows users to reset their passwords in the cloud and syncs those changes back to on-premises AD DS.

Step-by-Step Solution

1
Analyze the business continuity requirement
Since users must authenticate to cloud services even during an on-premises outage, the authentication must not depend on on-premises infrastructure. This rules out Pass-through Authentication (PTA) and Active Directory Federation Services (AD FS), pointing to Password Hash Synchronization (PHS).
PHS allows authentication requests to be handled entirely by Microsoft Entra ID in the cloud.
2
Analyze the self-service password reset (SSPR) requirement
Users must reset their passwords in the cloud and have the change reflected on-premises. This requires password writeback.
Password writeback is a feature of Microsoft Entra Connect that copies cloud-initiated password changes back to on-premises AD DS.
3
Evaluate the administrative overhead constraint
PHS has the lowest administrative overhead compared to PTA and AD FS, as it does not require hosting and maintaining additional authentication agents or complex federation infrastructure.
Minimizing administrative overhead is achieved by choosing the simplest model that meets all technical requirements.

Key Concept

Selecting the appropriate hybrid identity synchronization method and configuring password writeback to satisfy business continuity, administrative overhead, and self-service password reset constraints.
Rate this question

Topics

Hybrid and Multi-Tenant Identity Solutions

More questions from this topic