A financial services organization is designing an identity and access management solution for its Microsoft Entra ID tenant and hybrid Active Directory Domain Services (AD DS) environment. The design must satisfy the following requirements:
- Users must be able to authenticate to cloud services even during an on-premises WAN outage, without relying on on-premises infrastructure or authentication traffic routing.
- Privileged administrative roles must require Just-in-Time (JIT) activation, and users must be prompted for multi-factor authentication (MFA) when activating these roles.
- The configuration must guarantee that administrators can access the tenant and recover control in the event of a tenant-wide MFA service failure or Conditional Access policy misconfiguration.
- Standard employees must only access corporate applications from compliant, corporate-managed devices.
Which of the following authentication and access management strategies should you recommend?
- Configure hybrid identity using Password Hash Synchronization (PHS). Implement Privileged Identity Management (PIM) with eligible assignments for administrative roles. Define a Conditional Access policy requiring MFA and compliant devices for administrators, while excluding a dedicated emergency access account that is assigned the Global Administrator role permanently and has its credentials secured in a physical safe.Answer
- BConfigure hybrid identity using Active Directory Federation Services (AD FS). Implement Privileged Identity Management (PIM) with eligible assignments for administrative roles. Define a Conditional Access policy requiring MFA and compliant devices for administrators, while excluding a dedicated emergency access account that is assigned the Global Administrator role permanently and has its credentials secured in a physical safe.
- CConfigure hybrid identity using Password Hash Synchronization (PHS). Implement Privileged Identity Management (PIM) with eligible assignments for administrative roles. Define a Conditional Access policy requiring MFA and compliant devices for all administrative users, ensuring no administrative accounts are excluded from the MFA requirement to maintain a zero-trust posture.
- DConfigure hybrid identity using Password Hash Synchronization (PHS). Implement Privileged Identity Management (PIM) with active assignments for administrative roles. Define a Conditional Access policy requiring MFA and compliant devices for administrators, while excluding a dedicated emergency access account that is assigned the Global Administrator role permanently and has its credentials secured in a physical safe.