Examkin

Soru

Zorluk: Çok zorHybrid and Multi-Tenant Identity Solutions

Kestrel Aerospace has an on-premises Active Directory Domain Services (AD DS) forest named corp.kestrelaero.local. The company has a primary Microsoft Entra ID tenant (kestrelaero.com) and recently acquired a subsidiary that uses a separate Microsoft Entra ID tenant (sub.kestrelaero.com).

You are designing a hybrid and multi-tenant identity solution to meet the following requirements:
- Users in corp.kestrelaero.local must be able to access resources in both the kestrelaero.com and sub.kestrelaero.com tenants.
- Users must authenticate using their on-premises credentials, and password changes must be written back to the on-premises AD DS.
- Users must still be able to authenticate to cloud services even during an extended on-premises network outage.
- On-premises infrastructure overhead must be minimized.
- High-privilege administrative roles in the primary tenant must be protected using Privileged Identity Management (PIM) with zero permanent active assignments, and a Conditional Access policy must require multi-factor authentication (MFA) for all administrative logins.
- An emergency access account must be created to prevent administrative lockout.

Which of the following designs should you recommend?

  1. Configure Microsoft Entra Connect with Password Hash Synchronization (PHS) and password writeback to sync corp.kestrelaero.local to the kestrelaero.com tenant. Configure cross-tenant synchronization from kestrelaero.com to sub.kestrelaero.com. Define PIM roles as eligible, and exclude the emergency access account from the administrative MFA Conditional Access policy.Cevap
  2. B
    Configure Active Directory Federation Services (AD FS) on-premises. Deploy Microsoft Entra Connect on two separate servers to sync corp.kestrelaero.local directly to both kestrelaero.com and sub.kestrelaero.com using federation. Define PIM roles as eligible, and exclude the emergency access account from the administrative MFA Conditional Access policy.
  3. C
    Configure Microsoft Entra Connect with Password Hash Synchronization (PHS) and password writeback to sync corp.kestrelaero.local to the kestrelaero.com tenant. Configure cross-tenant synchronization from kestrelaero.com to sub.kestrelaero.com. Define PIM roles as eligible, and apply the administrative MFA Conditional Access policy to all administrative users, including the emergency access account, to ensure maximum security.
  4. D
    Configure Microsoft Entra Connect with Password Hash Synchronization (PHS) and password writeback to sync corp.kestrelaero.local to the kestrelaero.com tenant. Configure cross-tenant synchronization from kestrelaero.com to sub.kestrelaero.com. Configure PIM assignments as active for administrative users to simplify access, and exclude the emergency access account from the administrative MFA Conditional Access policy.

Cevap

The design that synchronizes corp.kestrelaero.local to the kestrelaero.com tenant using Microsoft Entra Connect with Password Hash Synchronization (PHS) and password writeback, uses cross-tenant synchronization from kestrelaero.com to sub.kestrelaero.com, defines PIM assignments as eligible, and excludes the emergency access account from the Conditional Access policy.
The correct design uses Password Hash Synchronization (PHS) with password writeback, which ensures on-premises passwords are sync'd to the cloud and allows self-service password reset (SSPR) writeback to AD DS. Because the hashes reside in the cloud, cloud authentication is preserved even if the on-premises datacenter loses connectivity. Additionally, cross-tenant synchronization resolves multi-tenant collaboration without violating the single-forest-to-single-tenant Entra Connect sync rule. Making administrative roles eligible in Privileged Identity Management (PIM) ensures zero permanent active assignments, and excluding the emergency access account from the administrative MFA policy adheres to recovery best practices.

Adım Adım Çözüm

1
Determine the synchronization and authentication method.
Password Hash Synchronization (PHS) with password writeback enabled.
PHS satisfies the requirement for minimizing local infrastructure overhead (compared to AD FS) and ensures authentication remains operational during an on-premises network outage because the hashes are stored in Microsoft Entra ID. Password writeback ensures SSPR works.
2
Design the multi-tenant collaboration model.
Cross-tenant synchronization from the primary tenant to the subsidiary tenant.
Direct synchronization of a single on-premises forest to multiple tenants using multiple Microsoft Entra Connect engines is not supported. Cross-tenant synchronization securely provisions users from the primary tenant to the subsidiary tenant as B2B users, allowing them to authenticate back to their home tenant.
3
Configure administrative security controls.
Define Privileged Identity Management (PIM) assignments as eligible.
Eligible assignments require users to elevate their privileges on-demand (JIT), meeting the requirement of zero permanent active assignments.
4
Apply Conditional Access policy exclusions.
Exclude the emergency access (break-glass) account from the administrative MFA policy.
Excluding the emergency access account prevents total tenant lockout in the event of an MFA service failure or key loss.

Anahtar Kavram

Designing resilient, secure, and operationally efficient hybrid and multi-tenant identity solutions using Microsoft Entra Connect, PHS, Cross-Tenant Synchronization, PIM, and Conditional Access exclusions.
Bu soruyu puanla

Konular

Hybrid and Multi-Tenant Identity Solutions

Bu konudan daha fazla soru