Microsoft 365 Certified: Administrator ExpertImplement and manage Microsoft Entra IDHard
A company is deploying Microsoft Entra Connect to synchronize identities from its on-premises Active Directory to Microsoft Entra ID. They have a strict security policy requiring that user passwords are NOT stored in the cloud in any form, including hashed versions. However, users must be able to use their on-premises Active Directory credentials to sign in to Microsoft 365 services. Which authentication method should you configure in Microsoft Entra Connect?
- APass-through Authentication (PTA)
- BSeamless Single Sign-On (SSO)
- CFederation with AD FS
- DPassword Hash Synchronization (PHS)
Show answer & explanationAnswer & explanation
Correct answer: C. Federation with AD FS
Federation with AD FS (Active Directory Federation Services) is the only authentication method among the options where user passwords never leave the on-premises Active Directory. Users authenticate directly against AD FS, which then issues tokens to Microsoft Entra ID, satisfying the requirement that no password data (even hashes) is stored in the cloud.
Why the other options are wrong
- A. PTA agents validate passwords against on-premises AD, but the password hashes are still processed in the cloud service before being forwarded to the agent, and the question implies strict avoidance of any cloud storage or processing of password data.
- B. Seamless SSO is a feature that works with PHS or PTA for a better user experience but is not an authentication method itself that dictates where the password resides.
- D. PHS synchronizes a hash of the password to Entra ID, which violates the 'NOT stored in the cloud in any form' requirement.
Microsoft Entra Connect Federation (AD FS)
An authentication method where Microsoft Entra ID trusts an on-premises Active Directory Federation Services (AD FS) instance to authenticate users.
- Passwords never leave the on-premises environment.
- AD FS issues security tokens to Microsoft Entra ID after on-premises authentication.
- Offers advanced features like smart card authentication or third-party MFA providers.
Memory trick: Hybrid Auth: Keep Passwords Home, or Sync and Share.