AZ-500 practice question 3 of 35

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result…

Choose your answer, then check it against the explanation.

Domain Manage identity and access

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements. Your company has an Active Directory forest with a single domain, named weylandindustries.com. They also have an Azure Active Directory (Azure AD) tenant with the same name. You have been tasked with integrating Active Directory and the Azure AD tenant. You intend to deploy Azure AD Connect. Your strategy for the integration must make sure that password policies and user logon limitations affect user accounts that are synced to the Azure AD tenant, and that the amount of necessary servers are reduced. Solution: You recommend the use of password hash synchronization and seamless SSO. Does the solution meet the goal?

Answer options

Correct Answer:

Explanation

The proposed solution using Password Hash Synchronization (PHS) and Seamless SSO does not meet all the stated requirements. While PHS is the most lightweight option in terms of server infrastructure, it does not enforce all on-premises Active Directory policies in real-time for cloud authentications.

Specifically, user logon limitations such as logon hours are not enforced by PHS because the authentication occurs against the password hash stored in Azure AD, not directly against the on-premises Active Directory. To enforce real-time policies like logon hours and ensure that password expiration policies are checked directly against the on-premises domain, Pass-through Authentication (PTA) or Active Directory Federation Services (AD FS) would be required. Therefore, the solution fails to meet the goal.

Why Incorrect

A. Yes: This is incorrect because the solution fails to enforce critical on-premises security policies like logon hours for cloud authentications, which is a specific requirement of the integration strategy.

References

1. Microsoft Entra documentation

"Choose the right authentication method for your Microsoft Entra hybrid identity solution

" Microsoft Learn. In the "Sign-in method comparison" table

the row for "Enforce on-premises user account policies (for example

logon hours)" clearly states "No" for Password hash synchronization and "Yes" for Pass-through authentication and Federation. This directly confirms that the proposed solution does not meet the requirement.

2. Microsoft Entra documentation

"What is password hash synchronization with Microsoft Entra ID?

" Microsoft Learn. This document explains that PHS synchronizes a hash of the password. It notes that some attributes like userAccountControl (which includes account disabled status) are synchronized

but it does not provide a mechanism for real-time policy checks like logon hours.

3. Microsoft Entra documentation

"Microsoft Entra Pass-through Authentication: How it works

" Microsoft Learn. This document details how PTA validates credentials directly against on-premises Active Directory. Section "How it works: Detailed description" explains that the on-premises Authentication Agent receives the request and validates it against Active Directory

which is the mechanism that allows for the enforcement of on-premises policies like account status

password validity

and logon hours.

Question 3 of 35

Keep practicing

Take the free AZ-500 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test