Examkin

Question

Difficulty: HardMicrosoft Entra ID Authentication and Conditional Access

An enterprise is designing a hybrid identity and access management solution. The enterprise currently synchronizes its on-premises Active Directory Domain Services (AD DS) environment to Microsoft Entra ID.

The design must satisfy the following requirements:
- Ensure that users can authenticate to cloud resources even if the on-premises network or AD DS domain controllers become unavailable.
- Require multi-factor authentication (MFA) for all administrative access to the Azure portal.
- Prevent administrative lockout of the tenant if there is a regional Microsoft Entra MFA service outage.
- Restrict administrative roles for standard IT administrators to just-in-time (JIT) access.

Which authentication and access control configuration should you recommend?

  1. A
    Implement Active Directory Federation Services (AD FS) for hybrid authentication. Configure a Conditional Access policy requiring multi-factor authentication (MFA) for administrative roles, and exclude a dedicated emergency access account that has a permanently assigned Global Administrator role.
  2. B
    Implement Password Hash Synchronization (PHS) for hybrid authentication. Configure a Conditional Access policy requiring multi-factor authentication (MFA) for administrative roles, and require all emergency access accounts to be configured as eligible for the Global Administrator role in Microsoft Entra Privileged Identity Management (PIM) without any policy exclusions.
  3. Implement Password Hash Synchronization (PHS) for hybrid authentication. Configure a Conditional Access policy requiring multi-factor authentication (MFA) for administrative roles, and exclude a dedicated emergency access account that has a permanently assigned Global Administrator role.Answer
  4. D
    Implement Password Hash Synchronization (PHS) for hybrid authentication. Configure all administrator accounts with permanently active Global Administrator roles in Microsoft Entra Privileged Identity Management (PIM) and apply a Conditional Access policy requiring multi-factor authentication (MFA) for all administrative roles.

Answer

The configuration that implements Password Hash Synchronization (PHS), requires multi-factor authentication (MFA) via Conditional Access for administrators with an exclusion for a permanently assigned emergency access account.
The correct solution uses Password Hash Synchronization (PHS) to allow independent cloud authentication during on-premises outages. It uses Privileged Identity Management (PIM) to enforce just-in-time (JIT) eligible role assignments for standard administrators. To prevent lockout during an MFA outage, a dedicated emergency access account is permanently assigned the Global Administrator role and explicitly excluded from the MFA Conditional Access policy.

Step-by-Step Solution

1
Select the hybrid authentication method that ensures cloud authentication resiliency.
Password Hash Synchronization (PHS) is selected instead of AD FS.
PHS allows authentication to be processed directly by Microsoft Entra ID, ensuring authentication availability even when on-premises domain controllers or network connectivity are offline.
2
Design the administration access method.
Standard administrative accounts are configured as eligible in Microsoft Entra Privileged Identity Management (PIM).
This meets the requirement to enforce just-in-time (JIT) administrative access rather than permanent access.
3
Configure the security policy for portal access and lockout prevention.
Create a Conditional Access policy requiring MFA for administrative roles, and exclude a dedicated emergency access account that has a permanently assigned Global Administrator role.
Excluding the emergency account from MFA ensures that if the MFA service is down or if there is a policy misconfiguration, administrators can still log in to remediate issues. The emergency account must have a permanent assignment because PIM activation requires access that may be unavailable during an outage.

Key Concept

Microsoft Entra ID Authentication, Conditional Access exclusions, and Privileged Identity Management resiliency configuration
Rate this question

Topics

Microsoft Entra ID Authentication and Conditional Access