Examkin

Question

Difficulty: MediumHybrid and Multi-Tenant Identity Solutions

Apex Biologics has an on-premises Active Directory Domain Services (AD DS) forest named ad.apexbiologics.com and two Microsoft Entra ID tenants: a corporate tenant (apexbiologics.com) and a research tenant (apexresearch.com).

You are designing a hybrid identity and multi-tenant solution with the following requirements:
- Users in the corporate tenant must be able to authenticate to Azure resources using their on-premises credentials.
- If the on-premises network or AD DS domain controllers go offline, users must still be able to sign in to Azure resources.
- Users must be able to reset their own passwords from the web, and these password changes must immediately write back to the on-premises AD DS.
- Corporate administrators must be able to collaborate securely with guest users in the research tenant without managing their accounts directly.

Which of the following configurations should you include in the hybrid identity design? (Select two.)

  1. Enable Password Hash Synchronization (PHS) as the hybrid authentication method in Microsoft Entra Connect.Answer
  2. Enable Password Writeback in Microsoft Entra Connect.Answer
  3. C
    Configure Pass-through Authentication (PTA) as the hybrid authentication method in Microsoft Entra Connect.
  4. D
    Deploy Active Directory Federation Services (AD FS) and federate the corporate tenant with the on-premises AD DS forest.

Answer

To satisfy the requirements, the hybrid identity design must include enabling Password Hash Synchronization (PHS) and enabling Password Writeback in Microsoft Entra Connect.
To support authentication during on-premises outages, the identity solution must use Password Hash Synchronization (PHS) because authentication occurs directly within Microsoft Entra ID without needing to contact on-premises domain controllers. To support self-service password resets that update on-premises AD DS, Password Writeback must be enabled in Microsoft Entra Connect.

Step-by-Step Solution

1
Evaluate the authentication and business continuity requirement during an on-premises outage.
Password Hash Synchronization (PHS) must be chosen. Unlike Pass-through Authentication (PTA) or Active Directory Federation Services (AD FS), PHS allows Microsoft Entra ID to authenticate users in the cloud without needing real-time connection to on-premises domain controllers.
This guarantees that users can sign in to Azure resources even if the on-premises network or domain controllers are offline.
2
Address the self-service password reset (SSPR) writeback requirement.
Enable Password Writeback in Microsoft Entra Connect.
Password writeback ensures that password changes made in Microsoft Entra ID are immediately written back to the on-premises AD DS directory.

Key Concept

Designing hybrid identity authentication, business continuity, and password writeback for Microsoft Entra ID.
Rate this question

Topics

Hybrid and Multi-Tenant Identity Solutions

More questions from this topic