Vortex Cloud Solutions has an on-premises Active Directory Domain Services (AD DS) forest named internal.vortexcloud.net with 5,800 users. You are designing a hybrid identity and security solution to integrate the on-premises forest with a new Microsoft Entra ID tenant.
The solution must satisfy the following requirements:
- Users must sign in to Microsoft Entra ID using their on-premises credentials.
- If the on-premises domain controllers or network connectivity is lost, users must still be able to authenticate to cloud services using their current passwords.
- Users must be allowed to reset their own passwords in Microsoft Entra ID, and these changes must be reflected immediately in the on-premises AD DS.
- To secure administrative access, a Conditional Access policy must enforce multi-factor authentication (MFA) for all global administrators, while mitigating the risk of tenant lockout during an MFA service outage.
- On-premises infrastructure requirements must be minimized.
Which solution should you recommend?
- Configure Microsoft Entra Connect with Password Hash Synchronization (PHS) and enable password writeback. Create a Conditional Access policy requiring MFA for the Global Administrator role, and exclude two dedicated emergency access accounts from the policy.Cevap
- BDeploy Active Directory Federation Services (AD FS) and enable password writeback. Create a Conditional Access policy requiring MFA for the Global Administrator role, and exclude two dedicated emergency access accounts from the policy.
- CConfigure Microsoft Entra Connect with Pass-through Authentication (PTA) and enable password writeback. Create a Conditional Access policy requiring MFA for the Global Administrator role, and exclude two dedicated emergency access accounts from the policy.
- DConfigure Microsoft Entra Connect with Password Hash Synchronization (PHS) and enable password writeback. Create a Conditional Access policy requiring MFA for the Global Administrator role without excluding any administrative accounts.