AZ-305 Question 27
Single answerA company has an existing on-premises Active Directory Domain Services (AD DS) environment with several thousand users. They plan to adopt multiple software-as-a-service (SaaS) applications in Azure but want to keep authentication consistent between on-premises and cloud services. They also require the ability to immediately revoke user access upon employee termination and seek to minimize additional on-premises infrastructure. Which identity solution should you recommend?
- A
Implement Azure AD Connect with Password Hash Synchronization
- B
Implement Azure AD Connect with Pass-through Authentication
- C
Deploy Active Directory Federation Services (AD FS) using an on-premises AD FS farm
- D
Enable Azure Active Directory Domain Services for domain-join capabilities
Show answer and explanation
Correct answer: B
Explanation
Azure AD Connect with Pass-through Authentication ensures passwords are validated directly against the on-prem directory in real-time, allowing for immediate revocation of access without requiring a full AD FS deployment. This solution also minimizes additional on-premises infrastructure compared to running a dedicated AD FS farm. For more details, refer to Microsoft’s documentation on choosing the right authentication method: https://learn.microsoft.com/azure/active-directory/hybrid/choose-ad-authn.
- A. Incorrect.
Option 1: Azure AD Connect with Password Hash Synchronization is straightforward and reduces on-premises infrastructure needs. However, account lockouts and revocations can be slightly delayed because passwords have to be synchronized. Although the delay is usually short, it is not always real-time, which doesn't fully meet the immediate revocation requirement.
- B. Correct.
Option 2: Azure AD Connect with Pass-through Authentication uses an agent on-premises to validate passwords against AD DS in real-time, ensuring immediate revocation and no added overhead of maintaining a full AD FS farm. This meets the company's need for immediate access revocation and minimal additional servers, making it the best choice.
- C. Incorrect.
Option 3: Deploying AD FS on-premises can provide immediate revocation, but it requires additional infrastructure (AD FS proxy, servers, load balancing), which the company wants to avoid. It also adds management complexity compared to pass-through authentication.
- D. Incorrect.
Option 4: Azure AD Domain Services is mainly for providing domain-join capabilities in Azure for legacy apps that require NTLM or Kerberos authentication, rather than enabling real-time authentication back to the on-prem environment. It does not directly address the immediate revocation requirement as effectively as pass-through authentication.