AZ-305 Question 35
Select 2A company wants to allow remote employees to access on-premises web applications securely. They already use Azure Active Directory (Azure AD) for cloud applications and want to require multi-factor authentication (MFA) for external access. They also want to keep their on-premises Active Directory as the central source for user credentials. Which two solutions would fulfill these requirements?
- A
Implement Azure AD Application Proxy with pass-through authentication and Azure AD pre-authentication
- B
Deploy the Network Policy Server (NPS) extension for Azure MFA on the on-premises RADIUS server
- C
Use a custom third-party SAML identity provider that does not integrate with Azure AD
- D
Deploy Active Directory Federation Services (AD FS) without Azure AD Connect, configuring custom claims rules
Show answer and explanation
Correct answers: A, B
Explanation
Using Azure AD Application Proxy or the NPS extension for Azure MFA maintains a consistent hybrid identity strategy where Azure AD is the primary authentication and MFA provider, while on-premises Active Directory remains the authoritative source of user credentials. These approaches align with Microsoft best practices for securing on-premises applications with Azure AD, as documented in Microsoft’s official documentation: https://learn.microsoft.com/azure/active-directory/. Properly integrating these services ensures that users enjoy seamless single sign-on with the added protection of multi-factor authentication.
- A. Correct.
Option 1: CORRECT. Azure AD Application Proxy with pass-through authentication and Azure AD pre-auth provides a secure way to publish on-premises web applications. Azure AD handles the MFA requirement, and authentication requests are passed through to the on-premises Active Directory for validation. This approach integrates well with existing Azure AD tenant configurations.
- B. Correct.
Option 2: CORRECT. The NPS extension for Azure MFA can enforce multi-factor authentication for RADIUS-based authentication requests from on-premises resources. This allows you to leverage Azure AD as the MFA authority while keeping user credentials in on-premises Active Directory.
- C. Incorrect.
Option 3: INCORRECT. A standalone third-party SAML identity provider that does not integrate with Azure AD would not meet the requirement to use Azure AD for MFA. You would lose the benefit of a single identity and authentication control in Azure AD.
- D. Incorrect.
Option 4: INCORRECT. Deploying AD FS without Azure AD Connect and using custom claims rules means the federated infrastructure is isolated from Azure AD. As a result, you cannot seamlessly leverage Azure AD MFA for on-premises applications if Azure AD is not integrated through Azure AD Connect.