Examkin

Question

Difficulty: MediumMicrosoft Entra ID Authentication and Conditional Access

CloudFin Associates is designing a hybrid identity and access management solution for their Microsoft Entra ID tenant. The organization requires that:

1. Users must sign in to cloud services using their on-premises Active Directory Domain Services (AD DS) passwords.
2. In the event of an on-premises datacenter outage, users must still be able to authenticate to cloud services without administrative intervention.
3. Administrative overhead and infrastructure complexity must be minimized.
4. Multi-factor authentication (MFA) must be enforced for all administrative roles, while ensuring that the organization does not get locked out of the tenant in an emergency.

Which of the following authentication and access control designs should you recommend?

  1. Implement Password Hash Synchronization (PHS) as the hybrid identity solution, deploy a Conditional Access policy enforcing multi-factor authentication for all administrators, and exclude a dedicated emergency access account from the policy.Answer
  2. B
    Implement Active Directory Federation Services (AD FS) as the hybrid identity solution, deploy a Conditional Access policy enforcing multi-factor authentication for all administrators, and exclude a dedicated emergency access account from the policy.
  3. C
    Implement Password Hash Synchronization (PHS) as the hybrid identity solution, deploy a Conditional Access policy enforcing multi-factor authentication for all administrators, and ensure that all administrative accounts, including the dedicated emergency access account, are subject to the policy.
  4. D
    Implement Password Hash Synchronization (PHS) as the hybrid identity solution, assign all administrative roles as permanently active using Privileged Identity Management (PIM), and enforce multi-factor authentication via Conditional Access without exclusions.

Answer

Implement Password Hash Synchronization (PHS) as the hybrid identity solution, deploy a Conditional Access policy enforcing multi-factor authentication for all administrators, and exclude a dedicated emergency access account from the policy.
The correct design uses Password Hash Synchronization (PHS) combined with a Conditional Access policy that enforces MFA for administrative roles while excluding a dedicated emergency access account. PHS requires the least on-premises infrastructure and ensures users can sign in using their synchronized passwords even if the on-premises servers go offline. Excluding the emergency access account ensures recovery capability in the event of an MFA failure.

Step-by-Step Solution

1
Evaluate the hybrid authentication methods based on availability and overhead requirements.
Password Hash Synchronization (PHS) is selected over Active Directory Federation Services (AD FS) because it has the lowest infrastructure complexity, requires no on-premises servers to perform cloud login validation, and continues to function if the on-premises datacenter goes offline.
This satisfies the requirements for minimizing administrative overhead and ensuring business continuity during an on-premises outage.
2
Determine the access security strategy for administrator accounts.
A Conditional Access policy is designed to enforce multi-factor authentication (MFA) for all administrative roles.
This satisfies the security requirement to enforce MFA for administrative access.
3
Ensure emergency access capability to prevent lockout.
Exclude a dedicated emergency access (break-glass) account from the administrator MFA policy.
This aligns with Microsoft best practices to prevent tenant lockout in case of MFA provider service disruptions.

Key Concept

Microsoft Entra ID hybrid authentication and Conditional Access design
Estimated Time:1m 30s
Rate this question

Topics

Microsoft Entra ID Authentication and Conditional Access