Examkin

Soru

Zorluk: ZorMicrosoft Entra ID Authentication and Conditional Access

An organization named Litware, Inc. is designing an identity and access management solution for their Microsoft Entra ID tenant. The organization has an on-premises Active Directory Domain Services (AD DS) environment.

The solution must meet the following requirements:
- Ensure that users can authenticate to cloud services even if the on-premises network or AD DS domain controllers are offline, with minimal configuration overhead and without requiring on-premises server infrastructure.
- Require multi-factor authentication (MFA) for all administrative roles.
- Prevent administrative lockout in the event of an MFA service outage or misconfiguration.
- Implement Privileged Identity Management (PIM) for the Global Administrator role to enforce just-in-time (JIT) access.

Which two actions should you recommend to meet the requirements?

  1. Configure Password Hash Synchronization (PHS) as the hybrid identity authentication method.Cevap
  2. Configure a Conditional Access policy that requires MFA for all administrative roles, and exclude emergency access accounts from the policy.Cevap
  3. C
    Deploy Active Directory Federation Services (AD FS) and configure federation for the custom domain.
  4. D
    Configure permanent active assignments in Privileged Identity Management (PIM) for the Global Administrator role.
  5. E
    Configure a Conditional Access policy that requires MFA for all administrative roles, ensuring that all emergency access accounts are included in the policy rules.

Cevap

Configure Password Hash Synchronization (PHS) as the hybrid identity authentication method, and configure a Conditional Access policy requiring MFA for administrative roles while excluding emergency access accounts.
The correct solution involves configuring Password Hash Synchronization (PHS) to ensure authentication resilience without requiring on-premises server infrastructure, and configuring a Conditional Access policy requiring MFA for administrators that excludes emergency access accounts to prevent tenant lockout during a service disruption.

Adım Adım Çözüm

1
Select the appropriate hybrid authentication method.
Password Hash Synchronization (PHS) is selected.
PHS allows authentication to occur entirely in Microsoft Entra ID, ensuring sign-in resilience if on-premises domain controllers are offline, with minimal management overhead compared to AD FS or Pass-through Authentication (PTA).
2
Design the Conditional Access policy for administrator MFA.
A Conditional Access policy is designed to require MFA for all administrative roles, with an explicit exclusion for emergency access accounts.
This configuration satisfies the MFA requirement for admins while safeguarding against tenant lockout if the MFA service or the policy itself is misconfigured.
3
Ensure just-in-time access configurations for privileged roles.
Users are configured with eligible PIM assignments rather than active assignments.
Eligible assignments require users to request and activate the role when needed, implementing just-in-time access and avoiding permanently active assignments.

Anahtar Kavram

Microsoft Entra ID hybrid authentication resilience and secure Conditional Access configuration for administrative accounts.
Bu soruyu puanla

Konular

Microsoft Entra ID Authentication and Conditional Access