Examkin

Soru

Zorluk: OrtaHybrid and Multi-Tenant Identity Solutions

Aetherius Aerospace has an on-premises Active Directory Domain Services (AD DS) forest integrated with a primary Microsoft Entra ID tenant. The company recently partnered with Quantum Labs, which operates its own separate Microsoft Entra ID tenant. You are designing a hybrid and multi-tenant identity solution to meet the following requirements:

- Aetherius Aerospace users must be able to authenticate to cloud services using their on-premises passwords, even if the on-premises datacenters or network links become completely unavailable.
- Aetherius Aerospace users must be able to reset their passwords using a self-service portal in the cloud, and the new passwords must immediately synchronize back to the on-premises AD DS.
- Quantum Labs users must be able to access shared applications in the Aetherius Aerospace tenant using their existing home credentials without creating duplicate accounts.
- To prevent tenant lockout during an identity provider outage, designated emergency access administrator accounts must be able to log in without being blocked by multi-factor authentication (MFA) requirements.

Which identity integration and access control design should you recommend?

  1. Configure Microsoft Entra Connect with Password Hash Synchronization (PHS) and Password Writeback for Aetherius Aerospace users. Configure Microsoft Entra B2B collaboration to invite Quantum Labs users as guests. Apply a Conditional Access policy requiring multi-factor authentication (MFA) for administrative and external access, with an explicit exclusion for emergency access accounts.Cevap
  2. B
    Configure Microsoft Entra Connect with Pass-through Authentication (PTA) and Password Writeback for Aetherius Aerospace users. Configure Microsoft Entra B2B collaboration to invite Quantum Labs users as guests. Apply a Conditional Access policy requiring multi-factor authentication (MFA) for all administrative and external access, without excluding emergency access accounts.
  3. C
    Deploy Active Directory Federation Services (AD FS) for Aetherius Aerospace user authentication. Use Microsoft Entra B2B collaboration to invite Quantum Labs users as guests. Configure a Conditional Access policy requiring multi-factor authentication (MFA) for administrative access, and assign the tenant administrator roles directly to individual user accounts.
  4. D
    Configure Microsoft Entra Connect with Password Hash Synchronization (PHS) but disable Password Writeback. Configure Microsoft Entra B2B collaboration to invite Quantum Labs users as guests. Configure Privileged Identity Management (PIM) to assign permanently active administrator roles to emergency access accounts.

Cevap

Configure Microsoft Entra Connect with Password Hash Synchronization (PHS) and Password Writeback for Aetherius Aerospace users, invite Quantum Labs users as guests via Entra B2B collaboration, and apply a Conditional Access policy requiring MFA for administrative and external access with an explicit exclusion for emergency access accounts.
The correct design uses Password Hash Synchronization (PHS) to ensure users can authenticate in the cloud during on-premises outages, and Password Writeback to support self-service password changes. It uses Microsoft Entra B2B to allow Quantum Labs users to authenticate with their home credentials, and it excludes emergency access accounts from MFA to prevent complete tenant lockout during an identity provider outage.

Adım Adım Çözüm

1
Determine the synchronization and authentication mechanism for the primary tenant.
Select Password Hash Synchronization (PHS) with Password Writeback.
PHS allows authentication to occur entirely in the cloud, satisfying the business continuity requirement if the on-premises network or domain controllers are offline. Password Writeback is required to support cloud-initiated Self-Service Password Reset (SSPR) writing back to the on-premises directory.
2
Establish the collaboration model for multi-tenant access.
Configure Microsoft Entra B2B collaboration to invite the external tenant's users as guests.
This allows Quantum Labs users to authenticate using their existing home tenant credentials, eliminating the need to manage duplicate accounts or synchronize their passwords.
3
Configure the security policy and emergency access exclusions.
Deploy a Conditional Access policy requiring MFA for administrative and guest access, and add the emergency access accounts to the exclusion list.
Excluding emergency access (break-glass) accounts from the MFA policy ensures that administrators can access the tenant even during a global or regional MFA service outage.

Anahtar Kavram

Designing a secure, resilient hybrid and multi-tenant identity solution using Microsoft Entra Connect PHS, B2B collaboration, and Conditional Access with emergency exclusions.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Hybrid and Multi-Tenant Identity Solutions

Bu konudan daha fazla soru