Examkin

Question

Difficulty: EasyHybrid and Multi-Tenant Identity Solutions

Vanguard Retailers has an on-premises Active Directory Domain Services (AD DS) domain. You are designing a hybrid identity solution to sync user accounts to a single Microsoft Entra ID tenant. The solution must meet the following requirements:
- Users must sign in to cloud services using their on-premises credentials.
- Users must be able to change their passwords in the cloud and have them update on-premises.
- Authentication must succeed even during an on-premises network outage.
- On-premises infrastructure footprint must be minimized.

Which synchronization method should you recommend?

  1. A
    Active Directory Federation Services (AD FS) federation with password writeback
  2. Password Hash Synchronization (PHS) with password writebackAnswer
  3. C
    Pass-through Authentication (PTA) with password writeback
  4. D
    Password Hash Synchronization (PHS) with administrator roles configured as permanently active in Privileged Identity Management (PIM)

Answer

Password Hash Synchronization (PHS) with password writeback
Password Hash Synchronization (PHS) with password writeback meets all requirements. PHS copies password hashes to Microsoft Entra ID, allowing authentication to succeed entirely in the cloud even during on-premises network or server outages. It has the smallest on-premises footprint, requiring only the Microsoft Entra Connect sync service. Enabling password writeback ensures that any password updates performed in the cloud are immediately synchronized back to the on-premises Active Directory Domain Services.

Step-by-Step Solution

1
Analyze the business continuity requirement.
Identify that authentication must succeed during an on-premises outage, which requires the authentication authority to reside in the cloud. This rules out Active Directory Federation Services (AD FS) and Pass-through Authentication (PTA).
Both AD FS and PTA rely on active on-premises infrastructure to complete authentication requests.
2
Evaluate the infrastructure and password self-service requirements.
Determine that Password Hash Synchronization (PHS) requires only the Microsoft Entra Connect sync agent on-premises, minimizing footprint. Password writeback must be enabled to sync cloud password changes back to AD DS.
PHS provides the lowest infrastructure footprint compared to federation or pass-through configurations.
3
Verify administrative access governance compliance.
Reject options that permanently assign privileged roles, as Privileged Identity Management (PIM) assignments should be configured as eligible rather than permanently active.
Ensuring roles are eligible supports just-in-time (JIT) access governance and minimizes administrative exposure.

Key Concept

Selecting a hybrid identity synchronization method that supports cloud-based authentication, password self-service writeback, and high availability during on-premises outages.
Rate this question

Topics

Hybrid and Multi-Tenant Identity Solutions

More questions from this topic