AZ-305 Question 21
Select 2Fabrikam, Inc. has an on-premises Active Directory (AD) environment with multiple domain controllers. They plan to host an intranet web application in Azure that both employees and external partner users will access. The company wants to enable single sign-on (SSO) for employees with minimal on-premises infrastructure changes, and they also want to securely collaborate with partner organizations on selected resources. Additionally, they require multi-factor authentication for all users. Which two solutions should you recommend to meet these requirements?
- A
Implement password hash synchronization with Azure AD to enable employee SSO
- B
Deploy Active Directory Federation Services (AD FS) for identity federation
- C
Create Azure AD Domain Services and invite partner accounts as guest users
- D
Configure Azure AD B2B for external partner collaboration
- E
Deploy pass-through authentication with Azure AD
Show answer and explanation
Correct answers: A, D
Explanation
By using Azure AD password hash synchronization (Option 1), Fabrikam can provide a straightforward SSO experience with minimal new infrastructure. This approach also integrates well with Azure Multi-Factor Authentication. To collaborate with partners, Azure AD B2B (Option 4) is recommended: it lets Fabrikam securely invite guest users, apply Conditional Access, and enforce MFA for external users. These choices adhere to Azure best practices for reducing on-premises complexity while enabling secure external collaboration. For more details, refer to Microsoft’s documentation on Azure AD Connect, password hash synchronization, and Azure AD B2B collaboration.
- A. Correct.
Option 1 is correct. With password hash synchronization, user credentials (in hashed form) are synced from on-prem AD to Azure AD, providing SSO with minimal additional infrastructure. This setup also supports Azure AD features like Conditional Access and MFA.
- B. Incorrect.
Option 2 is incorrect. While AD FS provides federation and SSO, it requires additional on-premises servers and configuration. Fabrikam wants minimal on-premises changes, making AD FS less desirable in this scenario.
- C. Incorrect.
Option 3 is incorrect. Azure AD Domain Services provides domain-join capabilities in the cloud, but it does not directly address secure external collaboration requirements. It also doesn't provide the same B2B federation capabilities that Azure AD B2B offers.
- D. Correct.
Option 4 is correct. Azure AD B2B collaboration allows organizations to invite partners as guest accounts within Azure AD, granting them controlled access to specific resources. It simplifies external collaboration and supports MFA enforcement.
- E. Incorrect.
Option 5 is incorrect. Pass-through authentication can enable SSO without storing hashes in Azure AD, but it still requires installed connectors on-prem. While viable, password hash sync (Option 1) is typically simpler to manage and already satisfies the 'minimal on-premises overhead' requirement.