AZ-305 Question 22
Single answerA global organization with a small IT team wants to provide seamless single sign-on (SSO) to its Azure-based applications and services. They currently use Active Directory on-premises and need to minimize additional on-premises infrastructure while still enforcing multi-factor authentication for remote users. Which authentication solution should you recommend?
- A
Deploy AD FS federation servers on-premises for SSO to Azure
- B
Create separate cloud-only accounts in Azure AD for all users
- C
Implement pass-through authentication with Azure AD Connect and enable Seamless SSO
- D
Use Azure AD Connect with password hash synchronization and enable Seamless SSO
Show answer and explanation
Correct answer: D
Explanation
Azure AD Connect with password hash synchronization and Seamless SSO is typically the simplest and most cost-effective choice when you want SSO but have minimal on-premises IT resources. It avoids the need to deploy and maintain AD FS servers or pass-through authentication agents, and it integrates well with Azure AD Conditional Access and multi-factor authentication. For more details, refer to Microsoft’s documentation on 'Choosing the right authentication method for your Azure AD hybrid identity solution' (https://docs.microsoft.com/azure/active-directory/hybrid/choose-ad-authn).
- A. Incorrect.
Option 1: Deploying AD FS federation requires additional on-premises servers and management. Although it offers SSO, it contradicts the organization's requirement to minimize on-premises infrastructure.
- B. Incorrect.
Option 2: Creating separate Azure AD cloud-only accounts offers no true SSO and forces users to manage two sets of credentials, increasing administrative overhead and reducing user satisfaction.
- C. Incorrect.
Option 3: While pass-through authentication with Azure AD Connect does minimize password storage in the cloud, it still requires on-premises agents and management. It’s suitable if you need to keep credentials on-premises, but it can be more complex to manage than password hash synchronization for a small IT team.
- D. Correct.
Option 4: Using Azure AD Connect with password hash synchronization and enabling Seamless SSO provides a straightforward and low-maintenance solution. It offers SSO for users, integrates easily with multi-factor authentication in Azure AD, and aligns with the requirement of minimizing on-premises infrastructure.