Examkin

Question

Difficulty: MediumHybrid and Multi-Tenant Identity Solutions

VeloSpire Logistics has an on-premises Active Directory Domain Services (AD DS) domain that syncs to a single Microsoft Entra ID tenant. You are designing a hybrid identity solution. The solution must meet the following requirements:

- Users must be able to authenticate to cloud resources using their on-premises credentials.
- If the on-premises network or domain controllers experience an outage, users must still be able to sign in to cloud services.
- Cloud-initiated password changes via self-service password reset (SSPR) must be written back to the on-premises AD DS environment.
- The on-premises infrastructure footprint and management overhead must be minimized.

Which hybrid identity synchronization and authentication method should you recommend?

  1. Microsoft Entra Connect with Password Hash Synchronization (PHS) and password writeback enabledAnswer
  2. B
    Microsoft Entra Connect with Pass-through Authentication (PTA) and password writeback enabled
  3. C
    Active Directory Federation Services (AD FS) and Microsoft Entra Connect with password writeback enabled
  4. D
    Microsoft Entra Connect with Password Hash Synchronization (PHS) and password writeback disabled

Answer

Microsoft Entra Connect with Password Hash Synchronization (PHS) and password writeback enabled
The correct option is Password Hash Synchronization (PHS) with password writeback enabled. PHS replicates user password hashes to Microsoft Entra ID, allowing authentication to occur completely in the cloud. This fulfills the business continuity requirement by allowing users to sign in during on-premises outages. Enabling password writeback ensures that cloud-initiated password changes via SSPR sync back to the local AD DS. This combination requires the least infrastructure compared to other methods.

Step-by-Step Solution

1
Evaluate the business continuity requirement during an on-premises outage.
Identify that authentication must occur in the cloud without relying on live on-premises connectivity, ruling out Pass-through Authentication (PTA) and Active Directory Federation Services (AD FS) since both require contact with on-premises servers to validate credentials.
To ensure authentication continues functioning during network or server downtime.
2
Evaluate the on-premises infrastructure and operational overhead constraint.
Determine that Password Hash Synchronization (PHS) has the lowest infrastructure footprint and management overhead as it requires no extra on-premises servers or certificates beyond the sync engine itself, unlike AD FS.
To minimize on-premises resource utilization and administrative cost.
3
Address the self-service capability requirements.
Verify that self-service password reset (SSPR) must have password writeback enabled so that updates to user passwords in Entra ID sync back to AD DS.
To satisfy the constraint that cloud-initiated password changes are reflected on-premises.

Key Concept

Hybrid identity synchronization and authentication methods selection based on availability, self-service, and infrastructure constraints
Rate this question

Topics

Hybrid and Multi-Tenant Identity Solutions

More questions from this topic