Microsoft Security, Compliance, and Identity Fundamentals (SC-900)Describe the capabilities of Microsoft EntraHard
A company is migrating its entire infrastructure to Azure and wants to ensure that all virtual machines (VMs) and Azure resources are automatically joined to a domain and managed using Group Policy Objects (GPOs), similar to their on-premises environment. They need a managed service that replicates Active Directory domain controller functionality within Azure without the overhead of deploying and maintaining IaaS domain controllers. Which Microsoft Entra capability fulfills this requirement?
- AMicrosoft Entra Connect
- BMicrosoft Entra Application Proxy
- CMicrosoft Entra B2B Collaboration
- DMicrosoft Entra Domain Services
Show answer & explanationAnswer & explanation
Correct answer: D. Microsoft Entra Domain Services
Microsoft Entra Domain Services provides a managed domain in Azure that is compatible with traditional Active Directory features like domain join, LDAP, Kerberos, and Group Policy, without the need to deploy and manage domain controllers as IaaS VMs. This directly addresses the need for GPO management and domain join for Azure resources.
Why the other options are wrong
- A. Microsoft Entra Connect synchronizes identities from on-premises AD to Microsoft Entra ID; it does not provide managed domain services in Azure.
- B. Application Proxy provides secure remote access to on-premises web applications, not domain services for Azure resources.
- C. B2B Collaboration manages external guest user identities, not core domain services for Azure infrastructure management.
Microsoft Entra Domain Services (Managed Domain)
A fully managed service in Azure that provides Active Directory domain services like domain join, Group Policy, LDAP, and Kerberos/NTLM authentication, enabling legacy applications and VMs to run in Azure without deploying and managing domain controllers.
- Managed domain for Azure VMs and applications.
- Supports domain join and Group Policy Objects (GPOs).
- Compatible with traditional AD authentication protocols (LDAP, Kerberos, NTLM).
Memory trick: Domain Services is your AD in the cloud, no hard hats required.