Examkin

Question

Difficulty: MediumMicrosoft Entra ID Authentication and Conditional Access

Solarize Logistics is designing an identity and access management solution for its Microsoft Entra ID tenant. The security and infrastructure teams specify the following requirements:
- Require multi-factor authentication (MFA) for all administrative access.
- Prevent administrative tenant lockout in the event of an Azure MFA service outage.
- Provide just-in-time (JIT) access for administrative roles.
- Minimize on-premises infrastructure overhead for hybrid identity synchronization.

Which set of design decisions should you recommend?

  1. A
    Deploy Active Directory Federation Services (AD FS) for hybrid identity, configure administrative roles in Privileged Identity Management (PIM) as eligible, and exclude a dedicated cloud-only emergency access account from the Conditional Access policy requiring MFA.
  2. Implement Password Hash Synchronization (PHS) for hybrid identity, configure administrative roles in Privileged Identity Management (PIM) as eligible, and exclude a dedicated cloud-only emergency access account from the Conditional Access policy requiring MFA.Answer
  3. C
    Implement Password Hash Synchronization (PHS) for hybrid identity, configure administrative roles in Privileged Identity Management (PIM) as active, and exclude a dedicated cloud-only emergency access account from the Conditional Access policy requiring MFA.
  4. D
    Implement Password Hash Synchronization (PHS) for hybrid identity, configure administrative roles in Privileged Identity Management (PIM) as eligible, and include all Global Administrator accounts in the Conditional Access policy requiring MFA without any exclusions.

Answer

Implement Password Hash Synchronization (PHS) for hybrid identity, configure administrative roles in Privileged Identity Management (PIM) as eligible, and exclude a dedicated cloud-only emergency access account from the Conditional Access policy requiring MFA.
The correct design decision combines Password Hash Synchronization (PHS) to minimize on-premises infrastructure, Privileged Identity Management (PIM) with eligible assignments for just-in-time access, and the exclusion of an emergency access account from Conditional Access policies to prevent lockout.

Step-by-Step Solution

1
Select the hybrid identity synchronization method with the lowest on-premises complexity.
Password Hash Synchronization (PHS) is selected.
PHS requires only the Azure AD Connect agent and has no additional server dependencies, unlike Active Directory Federation Services (AD FS) which requires federation servers, web application proxies, and certificate management.
2
Configure the administrative roles to support just-in-time (JIT) access governance.
Configure role assignments in Privileged Identity Management (PIM) as eligible.
Eligible assignments require administrators to explicitly activate their roles when executing tasks, ensuring they only hold privileges when necessary rather than permanently.
3
Design the Conditional Access policy to enforce MFA while safeguarding administrative access.
Exclude a cloud-only emergency access (glass-breaker) account from the MFA policy.
Excluding a dedicated emergency access account prevents administrators from being locked out of the tenant if the Azure MFA service is down or misconfigured.

Key Concept

Designing secure identity, authentication, and access policies in Microsoft Entra ID by combining PHS, PIM, and Conditional Access exclusions.
Estimated Time:1m 30s
Rate this question

Topics

Microsoft Entra ID Authentication and Conditional Access