Examkin

Question

Difficulty: MediumHybrid and Multi-Tenant Identity Solutions

Solis Renewable Technologies has an on-premises Active Directory Domain Services (AD DS) forest with 5,400 users. The company is designing a hybrid identity solution to integrate with a new Microsoft Entra ID tenant.

The solution must satisfy the following requirements:
- Users must be able to sign in using their existing on-premises credentials.
- Users must be able to reset their own passwords on-premises via the cloud portal.
- Authentication must continue to function even if the network connection between the on-premises datacenter and Azure is temporarily lost.
- The infrastructure complexity and administrative overhead of the identity sync solution must be minimized.

Which hybrid identity synchronization and authentication design should you recommend?

  1. Microsoft Entra Connect with Password Hash Synchronization (PHS) and Password Writeback enabled.Answer
  2. B
    Microsoft Entra Connect with Pass-through Authentication (PTA) and Password Writeback enabled.
  3. C
    Active Directory Federation Services (AD FS) with federation and Password Writeback enabled.
  4. D
    Microsoft Entra Connect with Password Hash Synchronization (PHS), with self-service password reset (SSPR) enabled in Microsoft Entra ID but Password Writeback disabled.

Answer

Microsoft Entra Connect with Password Hash Synchronization (PHS) and Password Writeback enabled.
Password Hash Synchronization (PHS) copies password hashes to Microsoft Entra ID, allowing authentication requests to be processed completely in the cloud. This ensures that authentication remains operational even if on-premises connectivity is lost. Enabling Password Writeback allows users to use Microsoft Entra ID Self-Service Password Reset (SSPR) to change or reset their passwords and have those changes updated in the on-premises Active Directory in real time. PHS also represents the lowest administrative overhead compared to federated or pass-through architectures.

Step-by-Step Solution

1
Evaluate the authentication availability constraint.
Real-time authentication solutions (Pass-through Authentication and Active Directory Federation Services) are ruled out because they fail when the on-premises network connection is lost.
Both PTA and AD FS rely on active on-premises connectivity to authenticate users, whereas PHS enables cloud-based authentication using synchronized password hashes.
2
Evaluate the self-service password reset constraint.
Password Writeback must be enabled in Microsoft Entra Connect.
Password Writeback is the specific feature that allows password changes made via Entra ID Self-Service Password Reset (SSPR) to sync back to the on-premises Active Directory.
3
Evaluate the administrative overhead and complexity constraint.
Confirm Password Hash Synchronization (PHS) as the primary option over AD FS and PTA.
PHS does not require any additional on-premises agents or federation server infrastructure, minimizing complexity and administrative cost.

Key Concept

Selecting and configuring hybrid identity sync and authentication methods to meet availability, self-service, and complexity requirements.
Rate this question

Topics

Hybrid and Multi-Tenant Identity Solutions

More questions from this topic