Soru

Zorluk: OrtaHybrid and Multi-Tenant Identity Solutions

Vortex Cloud Solutions has an on-premises Active Directory Domain Services (AD DS) forest named internal.vortexcloud.net with 5,800 users. You are designing a hybrid identity and security solution to integrate the on-premises forest with a new Microsoft Entra ID tenant.

The solution must satisfy the following requirements:
- Users must sign in to Microsoft Entra ID using their on-premises credentials.
- If the on-premises domain controllers or network connectivity is lost, users must still be able to authenticate to cloud services using their current passwords.
- Users must be allowed to reset their own passwords in Microsoft Entra ID, and these changes must be reflected immediately in the on-premises AD DS.
- To secure administrative access, a Conditional Access policy must enforce multi-factor authentication (MFA) for all global administrators, while mitigating the risk of tenant lockout during an MFA service outage.
- On-premises infrastructure requirements must be minimized.

Which solution should you recommend?

  1. Configure Microsoft Entra Connect with Password Hash Synchronization (PHS) and enable password writeback. Create a Conditional Access policy requiring MFA for the Global Administrator role, and exclude two dedicated emergency access accounts from the policy.Cevap
  2. B
    Deploy Active Directory Federation Services (AD FS) and enable password writeback. Create a Conditional Access policy requiring MFA for the Global Administrator role, and exclude two dedicated emergency access accounts from the policy.
  3. C
    Configure Microsoft Entra Connect with Pass-through Authentication (PTA) and enable password writeback. Create a Conditional Access policy requiring MFA for the Global Administrator role, and exclude two dedicated emergency access accounts from the policy.
  4. D
    Configure Microsoft Entra Connect with Password Hash Synchronization (PHS) and enable password writeback. Create a Conditional Access policy requiring MFA for the Global Administrator role without excluding any administrative accounts.

Cevap

Configure Microsoft Entra Connect with Password Hash Synchronization (PHS) and enable password writeback. Create a Conditional Access policy requiring MFA for the Global Administrator role, and exclude two dedicated emergency access accounts from the policy.
The correct option addresses all design constraints. Password Hash Synchronization (PHS) enables cloud-based authentication of synchronized accounts even if the on-premises network or Active Directory Domain Controllers are offline. Enabling password writeback ensures that changes from Self-Service Password Reset (SSPR) are immediately synchronized back to the on-premises Active Directory. Implementing a Conditional Access policy that enforces MFA for global administrators while excluding emergency access accounts protects the tenant from unauthorized access while mitigating the risk of administrative lockout during an MFA disruption. Finally, PHS minimizes the on-premises footprint compared to PTA and AD FS.

Adım Adım Çözüm

1
Evaluate authentication requirements for high availability and offline capability.
Password Hash Synchronization (PHS) is selected because it copies a hash of the user's password hash from on-premises to Microsoft Entra ID. This allows Microsoft Entra ID to authenticate users directly in the cloud, ensuring sign-in capabilities persist even if the on-premises domain controllers or network connections are offline. Pass-through Authentication (PTA) and Active Directory Federation Services (AD FS) both require active on-premises infrastructure to perform real-time authentication.
This guarantees business continuity and matches the requirement to allow authentication during on-premises outages.
2
Determine the synchronization mechanism needed for cloud-initiated password resets.
Password writeback must be enabled in Microsoft Entra Connect.
This ensures that when users change or reset their passwords via Microsoft Entra Self-Service Password Reset (SSPR), the change is immediately written back to the on-premises Active Directory Domain Services (AD DS) database.
3
Design the Conditional Access policy and lockout protection for administrative users.
A Conditional Access policy is configured to target the Global Administrator directory role and require MFA. To safeguard the tenant, two dedicated emergency access accounts (break-glass accounts) are created and explicitly excluded from this policy.
This prevents administrative lockout if the multi-factor authentication service is disrupted or misconfigured.

Anahtar Kavram

Designing high-availability hybrid identity and secure administration using Password Hash Synchronization, password writeback, and Conditional Access exclusions.
Bu soruyu puanla