Examkin

Question

Difficulty: MediumHybrid and Multi-Tenant Identity Solutions

Kestrel BioPharma has an on-premises Active Directory Domain Services (AD DS) forest containing 8,500 users. The company is designing a hybrid identity solution to integrate their AD DS forest with a new Microsoft Entra ID tenant. The solution must meet the following requirements:
- Users must sign in to cloud services using their on-premises credentials.
- The company must use Microsoft Entra ID Protection to identify compromised credentials that are leaked on the public internet.
- User authentication must succeed even if the on-premises network connection is temporarily unavailable.
- On-premises infrastructure requirements for authentication must be minimized.

Which identity synchronization and authentication method should you recommend?

  1. Password Hash Synchronization (PHS) with seamless Single Sign-On (SSO)Answer
  2. B
    Pass-through Authentication (PTA) with seamless Single Sign-On (SSO)
  3. C
    Active Directory Federation Services (AD FS) federation
  4. D
    Microsoft Entra Cloud Sync with pass-through authentication

Answer

Password Hash Synchronization (PHS) with seamless Single Sign-On (SSO)
Password Hash Synchronization (PHS) satisfies all requirements. It replicates a hash of the user's password hash to Microsoft Entra ID, which allows authentication to take place in the cloud. Consequently, users can sign in even if the on-premises network is offline. PHS is also the only synchronization method that natively allows Microsoft Entra ID Protection to evaluate password hashes against leaked credentials. Furthermore, it requires no on-premises infrastructure for the authentication pathway, unlike federation or pass-through agents.

Step-by-Step Solution

1
Analyze the security and sign-in requirements for compromised credential detection and network outage resiliency.
Determined that Microsoft Entra ID Protection's leaked credential detection requires password hashes to be present in Microsoft Entra ID, and that authentication must function when the on-premises network is offline.
These requirements exclude authentication options that validate passwords strictly on-premises in real-time.
2
Evaluate the remaining options against the footprint constraint to minimize on-premises infrastructure.
Password Hash Synchronization (PHS) satisfies the requirements by shifting authentication entirely to the cloud with minimal local setup.
Unlike federated identity or pass-through architectures, PHS does not require dedicated on-premises authentication servers or high-availability agents in the authentication path.

Key Concept

Selecting hybrid identity authentication methods based on resiliency, security features, and infrastructure constraints
Rate this question

Topics

Hybrid and Multi-Tenant Identity Solutions

More questions from this topic