An organization is designing a hybrid identity and security strategy for Microsoft Entra ID. You need to match each technical requirement to the most appropriate Microsoft Entra ID authentication method or Conditional Access control. Match each requirement on the left to the correct feature on the right.
- Authenticate users against on-premises Active Directory in real-time without hosting Federation servers or syncing password hashes to the cloud.Pass-through Authentication (PTA)
- Require multi-factor authentication (MFA) only when Microsoft Entra ID detects unusual properties during the token request process.Sign-in risk policy (Conditional Access)
- Force users to change their password when threat intelligence indicates that their credentials have been compromised.User risk policy (Microsoft Entra ID Protection)
- Prevent cloud app access from corporate-owned laptops that are not registered and flagged as healthy in Microsoft Intune.Require device to be marked as compliant grant control
Answer
To satisfy the requirements, pair Pass-through Authentication (PTA) with the local AD real-time authentication requirement; pair Sign-in risk policy with the anomaly detection requirement; pair User risk policy with the compromised credentials password change requirement; and pair the device compliance grant control with the Intune health verification requirement.
The correct pairings ensure that on-premises verification is handled by Pass-through Authentication without copying password hashes, session anomalies trigger Sign-in risk, credential leakage triggers User risk for password changes, and device health checked by Intune is validated via the device compliance grant control.
Step-by-Step Solution
Key Concept
Matching business authentication and access requirements to Entra ID hybrid authentication and Conditional Access capabilities.