AZ-305 Question 26
Single answerContoso wants to move its on-premises Active Directory user accounts to Azure Active Directory to manage identity for multiple SaaS applications. They want to enable single sign-on for users, support multi-factor authentication, and keep on-premises infrastructure to a minimum. Which approach should you recommend?
- A
Use Azure AD Connect with Password Hash Synchronization and Seamless Single Sign-On
- B
Deploy Active Directory Federation Services (AD FS) servers on-premises
- C
Use Azure AD Domain Services for all authentication traffic
- D
Enable Windows Hello for Business solely on domain-joined devices
Show answer and explanation
Correct answer: A
Explanation
Using Azure AD Connect with Password Hash Synchronization and Seamless Single Sign-On is typically recommended for organizations seeking cloud-based authentication with minimal on-premises infrastructure. Microsoft’s documentation highlights that this method simplifies deployment and still allows secure user authentication, including MFA. It enables users to use their on-premises credentials in Azure AD without continuously managing complex federation services.
- A. Correct.
Option 1 is correct. Azure AD Connect with Password Hash Synchronization and Seamless Single Sign-On provides a straightforward solution that reduces the on-premises footprint. It allows users to authenticate via Azure AD with their existing on-premises credentials (synced as password hashes), supports MFA, and delivers single sign-on to cloud apps with minimal infrastructure requirements.
- B. Incorrect.
Option 2 is incorrect. While AD FS offers a federated identity solution with single sign-on, it requires additional on-premises servers, proxies, and maintenance overhead, which contradicts the requirement to minimize infrastructure on-premises.
- C. Incorrect.
Option 3 is incorrect. Azure AD Domain Services provides domain-join capabilities and legacy protocol support in the cloud but does not itself handle direct single sign-on for SaaS applications. It also does not minimize on-premises infrastructure for Internet-based authentication, as it addresses different requirements (like extending domain services to Azure VMs).
- D. Incorrect.
Option 4 is incorrect. Windows Hello for Business is a strong credential solution (using PIN or biometrics), but by itself, it does not provide the broader identity management solution needed for multiple SaaS applications’ single sign-on, nor does it address the need to synchronize on-premises identities to Azure AD.