An IT team must allow on-premises users to log in to the Azure portal using their corporate credentials. Which strategy should be used to enable…

Identity federation enables users to access resources across different security domains using a single set of credentials. In this scenario, the goal is to link the on-premises identity system with Azure's identity system. Security Assertion Markup Language (SAML) is an open standard specifically designed for exchanging authentication and authorization data between an identity provider (the on-premises corporate directory) and a service provider (Azure). By configuring SAML-based authentication, the on-premises system can authenticate the user and send a trusted security assertion to Azure, which then grants access to the portal. This establishes the federated trust required for single sign-on (SSO).

A. Encrypting with Transport Layer Security (TLS): TLS is a protocol for securing data in transit. While essential for protecting the authentication exchange, it does not provide the identity federation mechanism itself.

B. Deploying a hardware-based two-factor authentication (2FA) solution: 2FA is a method for strengthening authentication by requiring a second verification factor. It is a component of an authentication process, not a strategy for federating identities between systems.

C. Integrating with lightweight directory access protocol (LDAP): LDAP is a protocol for querying and managing directory services. While the on-premises directory likely uses LDAP, it is not the protocol used to establish federated trust with an external service like Azure.

1. Microsoft Azure Documentation. "What is federation with Azure AD?". Microsoft Learn. This document explicitly states, "Federation is a collection of domains that have established trust... When you set up federation with your on-premises environment, you establish a trust relationship between your on-premises identity provider and Azure AD." It further identifies SAML 2.0 as a protocol used for this purpose.

2. National Institute of Standards and Technology (NIST). Special Publication (SP) 800-63C: Digital Identity Guidelines: Federation and Assertions. June 2017. Section 5.1.1, "Security Assertion Markup Language (SAML)", describes SAML as a framework for communicating authentication and authorization information between an Identity Provider (IdP) and a Relying Party (RP), which is the exact model of identity federation.

3. Internet2. SAML: The Secret to Centralized & Streamlined Authentication. InCommon Federation. This university-backed consortium material explains, "SAML is the underlying technology that enables federated identity management, allowing a person to use the same digital identity to access a wide variety of systems at their own institution and in the cloud." (Section: "What is SAML?").