You need to ensure that access to storage1 for the Marketing OU users meets the technical requirements. What should you implement?

To grant on-premises Active Directory users access to Azure resources, their identities must first be synchronized to Microsoft Entra ID. Microsoft Entra Connect cloud sync is a modern, lightweight agent designed for this purpose. It allows for targeted synchronization, which can be scoped to specific Organizational Units (OUs). By configuring cloud sync to synchronize only the "Marketing OU," the required user objects are provisioned in Microsoft Entra ID. These identities can then be granted access to the storage1 Azure Storage Account using Role-Based Access Control (RBAC), directly meeting the technical requirement.

B. Active Directory Federation Services (AD FS): AD FS is a federation service for handling authentication requests. It does not synchronize user or group objects to Microsoft Entra ID, which is required for assigning permissions.

C. Microsoft Entra Connect in staging mode: A server in staging mode is a passive backup. It reads data but does not write or export any changes to Microsoft Entra ID, so it cannot provision users.

D. Microsoft Entra Connect in active mode: While the traditional Entra Connect sync can also filter by OU, cloud sync is a more modern, lightweight solution better suited for targeted, OU-based synchronization from the cloud.

1. Microsoft Learn. (2023). What is Microsoft Entra Connect cloud sync?. In the "Key benefits" section

it explicitly lists the capability to "Scope synchronization to specific OUs." Retrieved from https://learn.microsoft.com/en-us/entra/identity/hybrid/cloud-sync/what-is-cloud-sync

2. Microsoft Learn. (2023). Microsoft Entra Connect: Staging server and disaster recovery. The "Staging mode" section states

"A server in staging mode does not run any export operations

" confirming it does not write to Microsoft Entra ID. Retrieved from https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sync-staging-server

3. Microsoft Learn. (2023). What is federation with Microsoft Entra ID?. This document clarifies that federation is an authentication mechanism

distinct from the synchronization of identity objects needed for authorization. Retrieved from https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/whatis-fed

4. Microsoft Learn. (2023). Compare cloud sync and Connect sync. This table highlights that both solutions support "Sync a specific OU

" but positions cloud sync as the lightweight agent solution. Retrieved from https://learn.microsoft.com/en-us/entra/identity/hybrid/cloud-sync/what-is-cloud-sync#comparison-between-microsoft-entra-connect-and-cloud-sync