Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that…

The goal is to enable authentication to an Azure HDInsight cluster using on-premises Active Directory credentials. This is achieved by using the HDInsight Enterprise Security Package (ESP), which allows the cluster to be joined to an Active Directory domain.

Azure Active Directory Domain Services (Azure AD DS) provides managed domain services (like Kerberos, NTLM, and LDAP) in Azure. In a hybrid identity scenario, Azure AD Connect synchronizes user identities and password hashes from on-premises AD to Azure AD. Azure AD DS then synchronizes these identities from Azure AD.

By deploying Azure AD DS and joining the HDInsight ESP cluster to this managed domain, users can authenticate using their synchronized on-premises credentials. Therefore, the proposed solution is correct.

B. No: This option is incorrect. Deploying Azure AD DS is a standard and officially documented method for enabling domain-join capabilities for services like HDInsight, which in turn allows authentication with on-premises credentials in a hybrid setup.

1. Microsoft Docs

"Plan for Azure HDInsight clusters with Enterprise Security Package": This document outlines the prerequisites for using ESP. It explicitly states

"ESP clusters require Azure AD DS... If you're using Azure Active Directory Domain Services (Azure AD DS)

then Azure AD Connect synchronizes on-premises identities to Azure AD. This is a prerequisite for ESP clusters." This confirms that Azure AD DS is the required component for this scenario.

2. Microsoft Docs

"What is Azure Active Directory Domain Services?": This document explains the function of Azure AD DS. Under the "How does Azure AD DS work?" section

it details that "Azure AD DS integrates with your Azure AD tenant... This integration lets users sign in to services and applications connected to the managed domain using their existing credentials." This supports the solution's mechanism.

3. Microsoft Docs

"Configure HDInsight clusters with Enterprise Security Package by using Azure Active Directory Domain Services": This tutorial provides a step-by-step guide for implementing the exact solution proposed. The introduction states

"In this article

you learn how to create and configure an Azure HDInsight cluster with Enterprise Security Package (ESP) by using Azure Active Directory Domain Services (Azure AD DS)." This serves as a practical confirmation of the solution's validity.