Examkin

Soru

Zorluk: Çok zorHybrid and Multi-Tenant Identity Solutions

AuraPharma Group has an on-premises Active Directory Domain Services (AD DS) forest named corp.aurapharma.com and two Microsoft Entra ID tenants: aurapharma.com (primary tenant) and auraresearch.com (research division tenant). You are designing a hybrid and multi-tenant identity solution to meet the following requirements:

* Users in the on-premises forest must authenticate to Azure resources using their local credentials.
* In the event of an on-premises network or domain controller outage, users must still be able to sign in to cloud applications.
* Users must be able to change their passwords in Microsoft Entra ID and have those changes apply immediately to the on-premises AD DS.
* To prevent administrative lockout under extreme conditions, emergency break-glass accounts must bypass Multi-Factor Authentication (MFA).
* Research division users must be able to access line-of-business applications registered in the primary tenant without registering new credentials, while using their own tenant's MFA state.

Which hybrid identity and access design should you recommend?

  1. Configure Microsoft Entra Connect to use Password Hash Synchronization (PHS) with seamless single sign-on (SSO), and enable password writeback. In the primary tenant, configure cross-tenant access settings to trust MFA from the research tenant. Create a Conditional Access policy requiring MFA for all users, excluding the designated emergency access accounts.Cevap
  2. B
    Configure Microsoft Entra Connect to use Pass-through Authentication (PTA) with seamless single sign-on (SSO), and enable password writeback. In the primary tenant, configure cross-tenant access settings to trust MFA from the research tenant. Create a Conditional Access policy requiring MFA for all users, excluding the designated emergency access accounts.
  3. C
    Configure Active Directory Federation Services (AD FS) for federated identity synchronization and authentication. In the primary tenant, configure cross-tenant access settings to trust MFA from the research tenant. Create a Conditional Access policy requiring MFA for all users, excluding the designated emergency access accounts.
  4. D
    Configure Microsoft Entra Connect to use Password Hash Synchronization (PHS) with seamless single sign-on (SSO), and enable password writeback. In the primary tenant, configure cross-tenant access settings to trust MFA from the research tenant. Create a Conditional Access policy requiring MFA for all users and administrative accounts, with no exemptions.

Cevap

Configure Microsoft Entra Connect to use Password Hash Synchronization (PHS) with seamless single sign-on (SSO), and enable password writeback. In the primary tenant, configure cross-tenant access settings to trust MFA from the research tenant. Create a Conditional Access policy requiring MFA for all users, excluding the designated emergency access accounts.
The correct option implements Password Hash Synchronization (PHS), which satisfies the business continuity requirement by allowing users to log in directly to cloud apps when on-premises systems are offline. It enables password writeback to support self-service password reset (SSPR) from Microsoft Entra ID back to the local AD DS. For multi-tenant collaboration, configuring cross-tenant access settings to trust MFA from the research tenant enables B2B collaboration without requiring users to register MFA twice. Finally, excluding the emergency break-glass account from the Conditional Access MFA policy protects the tenant from total administrative lockout.

Adım Adım Çözüm

1
Determine the synchronization and authentication method that provides business continuity during on-premises outages.
Password Hash Synchronization (PHS) is selected because authentication is performed entirely within Microsoft Entra ID, ensuring user access is maintained even when on-premises domain controllers or network links are offline.
Alternative methods like Pass-through Authentication (PTA) or Active Directory Federation Services (AD FS) rely on on-premises infrastructure for the authentication request path, meaning an outage will prevent cloud logins.
2
Configure self-service password reset capabilities.
Enable password writeback in Microsoft Entra Connect.
Password writeback is required to allow users who reset or change their password in the cloud to have that change written back to the on-premises Active Directory Domain Services immediately.
3
Configure secure and seamless cross-tenant collaboration.
Set up Microsoft Entra B2B collaboration and configure cross-tenant access settings in the primary tenant to trust Multi-Factor Authentication (MFA) from the research division tenant.
This allows research division users to authenticate using their home tenant's credentials and MFA status, preventing double prompt overhead and avoiding additional administrative setup.
4
Configure Conditional Access rules and emergency access.
Define a Conditional Access policy requiring MFA for all users, but explicitly exclude the break-glass/emergency access administrator accounts.
Excluding emergency accounts prevents administrative tenant lockout if external MFA mechanisms fail or are inaccessible.

Anahtar Kavram

Designing a resilient, secure hybrid identity and multi-tenant collaboration architecture using Microsoft Entra Connect and cross-tenant access settings.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Hybrid and Multi-Tenant Identity Solutions

Bu konudan daha fazla soru