Examkin

Soru

Zorluk: KolayMicrosoft Entra ID Authentication and Conditional Access

An organization is designing a hybrid identity architecture to connect their on-premises Active Directory Domain Services (AD DS) environment to Microsoft Entra ID. How should you match each security or authentication requirement to the correct Microsoft Entra ID authentication or Conditional Access feature?

  • Require multi-factor authentication (MFA) when users access cloud applications from outside the corporate office network.Conditional Access policy with location and grant controls
  • Validate user credentials against the on-premises Active Directory using a lightweight local agent, without storing password hashes in the cloud.Pass-through Authentication (PTA)
  • Verify user identity in the cloud by comparing credential hashes against synchronized password hashes stored in Microsoft Entra ID.Password Hash Synchronization (PHS)

Cevap

Require MFA outside corporate network matches Conditional Access policy with location and grant controls; Validate credentials on-premises without cloud hashes matches Pass-through Authentication (PTA); Verify identity with synchronized cloud hashes matches Password Hash Synchronization (PHS).
Conditional Access policies evaluate network location signals and enforce MFA grant controls. Pass-through Authentication (PTA) routes credential checks directly to on-premises AD via local agents without storing cloud hashes. Password Hash Synchronization (PHS) synchronizes user password hashes to enable cloud-native authentication.

Adım Adım Çözüm

1
Analyze the first requirement: requiring MFA when users connect from outside the corporate network.
This requires checking the user's location (network signal) and enforcing an access control (MFA), which is a key capability of Conditional Access policies.
Conditional Access evaluates signals like location to enforce organization policies.
2
Analyze the second requirement: validating credentials against on-premises Active Directory using a lightweight local agent without storing hashes in the cloud.
This aligns with Pass-through Authentication (PTA), which forwards the authentication request to an on-premises agent.
PTA keeps credentials validation on-premises and does not store user passwords or hashes in the cloud.
3
Analyze the third requirement: verifying user identity in the cloud using synchronized password hashes.
This aligns with Password Hash Synchronization (PHS), which synchronizes a hash of the user's on-premises Active Directory password hash.
PHS allows authentication to occur directly in Microsoft Entra ID using stored hashes.

Anahtar Kavram

Microsoft Entra ID hybrid authentication and Conditional Access policy design
Bu soruyu puanla

Konular

Microsoft Entra ID Authentication and Conditional Access