Microsoft Certified: Azure Solutions Architect ExpertDesign identity, governance, and monitoring solutionsMedium
A global pharmaceutical company is migrating its on-premises applications to Azure. They require a centralized identity solution that integrates with their existing on-premises Active Directory (AD) and allows users to seamlessly access cloud-based applications without re-entering credentials. The solution must also support multi-factor authentication (MFA) for enhanced security. Which Azure identity solution should be recommended?
- AAzure AD Domain Services (AAD DS)
- BAzure AD Connect with Pass-through Authentication (PTA)
- CAzure AD Application Proxy
- DAzure Active Directory B2C
Show answer & explanationAnswer & explanation
Correct answer: B. Azure AD Connect with Pass-through Authentication (PTA)
Azure AD Connect with Pass-through Authentication (PTA) allows users to sign in to both on-premises and cloud applications using the same passwords. It validates credentials directly against the on-premises AD, ensuring seamless single sign-on (SSO) and supporting MFA.
Why the other options are wrong
- A. AAD DS provides managed domain services in Azure but doesn't primarily focus on direct authentication against an existing on-premises AD for cloud apps.
- C. Azure AD Application Proxy provides secure remote access to on-premises web apps, not an identity synchronization and authentication solution itself.
- D. Azure AD B2C is for customer-facing applications, not internal enterprise identity integration.
Azure AD Connect with PTA
Azure AD Connect with Pass-through Authentication (PTA) is a sign-in method that validates user passwords directly against the on-premises Active Directory when they try to access Azure AD-connected applications.
- Provides single sign-on (SSO) for hybrid environments.
- Does not store user passwords in Azure AD.
- Requires agents to be installed on-premises.
Memory trick: Connect on-premises to cloud, pass-through securely.