AZ-305 Question 23
Single answerContoso Ltd. has an on-premises Active Directory for 15,000 employees and wants to provide single sign-on (SSO) for Microsoft 365 and other Azure-based services. They have limited IT resources and want to minimize additional infrastructure while ensuring users do not frequently reauthenticate. Which authentication method should you recommend?
- A
Deploy Azure AD Connect with Pass-through Authentication (PTA) only
- B
Use Azure AD Domain Services instead of Azure AD Connect
- C
Federate on-premises AD with AD FS and set up SSO
- D
Enable Azure AD Connect with Password Hash Synchronization and Seamless SSO
Show answer and explanation
Correct answer: D
Explanation
According to Microsoft best practices, Azure AD Connect with Password Hash Synchronization and Seamless SSO meets the requirement of minimizing on-premises overhead while providing a simple, effective single sign-on experience. References: Microsoft documentation on Azure AD Connect (https://docs.microsoft.com/azure/active-directory/hybrid/how-to-connect-install-prerequisites) states that Password Hash Sync and Seamless SSO offer a straightforward approach for most organizations needing SSO with reduced infrastructure complexity.
- A. Incorrect.
Incorrect: While PTA can provide secure validation of passwords on-premises and allow SSO, it requires an additional on-premises component (the PTA agent) running in a robust way. It might not be as straightforward to manage compared to Password Hash Sync for a large number of users when minimal infrastructure overhead is desired.
- B. Incorrect.
Incorrect: Azure AD Domain Services provides domain-join capabilities in Azure for virtual machines and services that need traditional AD Domain Services. It does not replace the need for Azure AD Connect in a scenario focusing on user authentication and SSO for Microsoft 365 and other Azure services.
- C. Incorrect.
Incorrect: Setting up an AD FS federation requires more on-premises hardware and maintenance. While it provides SSO, it adds complexity and cost by needing additional servers and certificate management. This conflicts with the requirement to limit infrastructure overhead.
- D. Correct.
Correct: Password Hash Synchronization with Seamless SSO via Azure AD Connect is typically recommended for organizations that want to reduce on-premises infrastructure. It requires less maintenance than federation or standalone PTA, and automatically signs in users from corporate devices with minimal reauthentication.