Solas Renewable Solutions is designing a hybrid and multi-tenant identity solution to support its growing infrastructure. The company has an on-premises Active Directory Domain Services (AD DS) forest and has recently acquired a subsidiary with its own Microsoft Entra ID tenant.
Solas has the following identity and access management requirements:
- Ensure that users from the corporate office can sign in to Microsoft Entra ID services even if the on-premises datacenter goes offline.
- Enable automatic account lifecycle management and Global Address List (GAL) visibility for users from the acquired subsidiary's tenant.
- Allow external suppliers to securely access internal resources using their existing corporate credentials.
- Ensure that certain security-sensitive on-premises users have their login credentials validated in real-time against on-premises domain controllers, without storing password hashes in the cloud.
You need to recommend the appropriate identity technology for each requirement.
Match the identity requirements on the left with the correct Microsoft Entra feature or configuration on the right.
- On-premises users must sign in to Microsoft Entra ID using their on-premises passwords. The authentication must be processed entirely in the cloud to ensure sign-in availability during an on-premises network outage.Password Hash Synchronization (PHS)
- External partners must access corporate line-of-business applications. They must use their own corporate or social identities, and Solas must not manage their password resets or lifecycles.Microsoft Entra B2B collaboration
- A newly acquired business unit with its own Microsoft Entra ID tenant must have its user accounts automatically provisioned and updated in the Solas corporate tenant to facilitate search in the global address list.Cross-tenant synchronization
- User authentication requests must be validated in real-time against the on-premises Active Directory Domain Services (AD DS) using lightweight agents, without storing password hashes in the cloud.Pass-through Authentication (PTA)