Examkin

Question

Difficulty: HardHybrid and Multi-Tenant Identity Solutions

Aetheris Dynamics is designing a hybrid identity and multi-tenant architecture to integrate four newly acquired business units (BU1, BU2, BU3, and BU4). You must match each business unit's technical requirements to the appropriate Microsoft Entra ID implementation.

- BU1 requires that users authenticate directly against the on-premises Active Directory Domain Services (AD DS) domain controllers. Authentication must happen on-premises to enforce local login hour restrictions without the complexity of Active Directory Federation Services (AD FS). The solution must remain available if a single on-premises server hosting the synchronization agent fails.
- BU2 requires the highest level of business continuity for authentication, allowing users to sign in to cloud services even during an on-premises network outage. Additionally, users must be able to change their passwords in the cloud, which must immediately update on-premises AD DS.
- BU3 has a security policy that strictly prohibits on-premises user password hashes or credentials from ever being stored in the cloud. User authentication must be federated, utilizing existing on-premises smart card infrastructure, and must support complex multi-factor authentication (MFA) policies managed entirely on-premises.
- BU4 needs to allow external contractors, who manage their own identity providers, to access specific Azure resources. Access must be restricted to a pre-defined duration, and the contractors must be automatically removed when their contract ends.

Match each business unit to the correct hybrid identity or multi-tenant solution component.

  • BU1: Direct on-premises authentication enforcing login hours, without AD FS, supporting agent high availability.Microsoft Entra Pass-Through Authentication (PTA) with redundant authentication agents
  • BU2: Authentication business continuity during on-premises outages, with cloud-initiated password resets updating on-premises.Microsoft Entra Password Hash Synchronization (PHS) with Password Writeback enabled
  • BU3: Zero password hashes in the cloud, federated authentication via smart cards, on-premises managed MFA.Active Directory Federation Services (AD FS) federation with Microsoft Entra ID
  • BU4: Time-bound external contractor access with self-executing removal using external identity providers.Microsoft Entra B2B collaboration with access packages in Entitlement Management

Answer

BU1 matches with Pass-Through Authentication (PTA) with redundant agents; BU2 matches with Password Hash Synchronization (PHS) with Password Writeback; BU3 matches with AD FS federation; BU4 matches with B2B collaboration with access packages.
Each business unit's constraints map to a distinct hybrid or multi-tenant solution. Pass-Through Authentication (PTA) satisfies BU1 by keeping authentication local (enforcing login hours) and using redundant agents for high availability. Password Hash Synchronization (PHS) with Password Writeback satisfies BU2 by enabling cloud authentication during local network outages and allowing self-service changes to write back. AD FS federation satisfies BU3 by ensuring zero hashes enter the cloud while supporting local smart cards and MFA. Entitlement Management access packages satisfy BU4 by automating the lifecycle of external B2B guest identities.

Step-by-Step Solution

1
Analyze BU1's requirements: direct on-premises authentication, dynamic login hour enforcement, no AD FS, agent redundancy.
Determine that Pass-Through Authentication (PTA) is the correct choice because it evaluates login policies locally on domain controllers without copying password hashes, requires no complex AD FS infrastructure, and supports high availability via multiple authentication agents.
Validates local auth control and minimizes management overhead.
2
Analyze BU2's requirements: maximum authentication business continuity during on-premises connectivity outages and cloud-initiated self-service password reset (SSPR).
Determine that Password Hash Synchronization (PHS) with Password Writeback is correct. PHS allows Entra ID to authenticate users even if the on-premises network is completely offline, and Password Writeback permits cloud password changes to write back to the local AD DS.
Aligns with the cloud-fallback capability of PHS and the writeback requirement.
3
Analyze BU3's requirements: zero credentials/hashes in the cloud, smart card integration, and on-premises managed MFA.
Determine that Active Directory Federation Services (AD FS) is the correct choice. It delegates authentication entirely to the local environment via token exchange, which supports smart card logon and allows MFA policies to remain strictly on-premises.
Meets the zero-cloud-hash and advanced on-premises federation constraints.
4
Analyze BU4's requirements: dynamic access for external contractors managing their own identity providers, with automated time-bound lifecycle expiration.
Determine that Microsoft Entra B2B collaboration coupled with access packages in Entitlement Management is correct. B2B allows guest access using their external IdPs, and access packages automate access assignment and automatic revocation based on date/time policies.
Applies multi-tenant external collaboration and identity governance principles.

Key Concept

Hybrid and Multi-Tenant Identity Solutions
Estimated Time:3m 0s
Rate this question

Topics

Hybrid and Multi-Tenant Identity Solutions

More questions from this topic