Examkin

Question

Difficulty: HardMicrosoft Entra ID Authentication and Conditional Access

An organization named CloudCrest Logistics is designing a secure hybrid identity and access control solution using Microsoft Entra ID. The solution must support synchronization of user identities from their on-premises Active Directory Domain Services (AD DS) environment. The organization has the following requirements:
- Users must be able to sign in using their on-premises passwords, and authentication must occur on-premises to satisfy regulatory compliance. If the on-premises connection fails, users must temporarily be able to sign in via cloud-based authentication as a backup.
- Multi-factor authentication (MFA) must be enforced for all users accessing the Azure portal, except for a dedicated glass-breaker emergency access account which must be excluded to prevent tenant lockout.

Which two configurations should you include in the design?

  1. Configure Microsoft Entra Connect to use Pass-through Authentication (PTA) as the primary sign-in method and enable Password Hash Synchronization (PHS) as a backup.Answer
  2. Configure a Conditional Access policy targeting the Microsoft Azure Management app that requires multi-factor authentication, and explicitly exclude a dedicated emergency access account from this policy.Answer
  3. C
    Deploy Active Directory Federation Services (AD FS) to perform federated on-premises authentication, without configuring password hash synchronization.
  4. D
    Configure a Conditional Access policy that enforces multi-factor authentication for all administrators accessing the Azure Portal, without excluding any accounts, to guarantee that no account can bypass MFA.

Answer

To meet the requirements, you should configure Pass-through Authentication (PTA) with Password Hash Synchronization (PHS) as a backup, and configure a Conditional Access policy requiring multi-factor authentication while excluding the emergency access account.
The correct configurations are to use Pass-through Authentication (PTA) with Password Hash Synchronization (PHS) as a backup, and to configure a Conditional Access policy requiring multi-factor authentication while excluding the emergency access account. PTA ensures on-premises authentication occurs for compliance, while enabling PHS as a backup allows users to authenticate in the cloud if the on-premises infrastructure is unavailable. Excluding the emergency access account from the MFA policy prevents tenant lockout in case of MFA service disruptions.

Step-by-Step Solution

1
Analyze authentication requirements to determine the appropriate hybrid identity configuration.
Identify that Pass-through Authentication (PTA) provides on-premises validation to meet compliance, while Password Hash Synchronization (PHS) serves as a cloud-based backup.
Regulatory compliance requires on-premises password validation, but business continuity demands a cloud-based authentication backup during outages.
2
Analyze access control and resiliency requirements for administration.
Determine that a Conditional Access policy should enforce multi-factor authentication (MFA) for Azure portal access, with an exclusion rule for the emergency access account.
Excluding the emergency access account is a critical resiliency best practice to prevent permanent tenant lockout during MFA service disruptions.

Key Concept

Microsoft Entra ID hybrid authentication and Conditional Access design
Rate this question

Topics

Microsoft Entra ID Authentication and Conditional Access