AZ-305 Question 24
Select 2Contoso, an organization with an existing on-premises Active Directory domain, wants to reduce on-premises infrastructure while enabling secure collaboration. They plan to move all employees to Microsoft 365 and allow external business partners to collaborate on SharePoint Online. They need minimal user disruption, seamless single sign-on (SSO), and a straightforward way to add or remove external partner access. You are tasked with designing their identity management solution. Which two recommendations should you include in the design?
- A
Implement Azure AD Connect with Password Hash Synchronization for employee accounts
- B
Enable Azure AD B2B collaboration for external partner access
- C
Use Azure AD B2C for external business partner authentication
- D
Deploy Active Directory Federation Services (AD FS) in the perimeter network
Show answer and explanation
Correct answers: A, B
Explanation
By combining Azure AD Connect with Password Hash Synchronization and Azure AD B2B, Contoso can achieve seamless SSO for employees with minimal on-premises infrastructure and securely grant external partner access. Password hash sync is a straightforward alternative to federation and aligns with Microsoft best practices for hybrid identity (see https://learn.microsoft.com/azure/active-directory/hybrid/whatis-hybrid-identity). Azure AD B2B provides a secure, easy-to-manage solution for external collaborators and is recommended over Azure AD B2C for partner scenarios (see https://learn.microsoft.com/azure/active-directory/b2b/).
- A. Correct.
Option 1 is CORRECT. Azure AD Connect with Password Hash Synchronization is a recommended approach for organizations wanting to reduce their on-premises footprint while maintaining a synchronized identity environment. It provides seamless SSO without requiring on-premises Federation Services, helping minimize administrative overhead.
- B. Correct.
Option 2 is CORRECT. Azure AD B2B collaboration is designed specifically for allowing partner and supplier access to corporate resources like SharePoint Online. It streamlines external user management and provides secure access control. This approach helps Contoso meet its external collaboration requirements.
- C. Incorrect.
Option 3 is INCORRECT. Azure AD B2C is primarily intended for consumer-facing applications where users sign up with personal social accounts (e.g., Facebook, Google) or local accounts. It is not the most efficient solution for a business-to-business collaboration scenario with external partners.
- D. Incorrect.
Option 4 is INCORRECT. Deploying AD FS would introduce additional on-premises infrastructure requirements. While AD FS can be used for federation, this contradicts Contoso's goals of reducing on-premises systems and does not offer simpler external collaboration than Azure AD B2B.