Microsoft Certified: Identity and Access Administrator AssociateImplement an authentication and access management solutionMedium
A company is implementing Azure AD Connect to synchronize identities from its on-premises Active Directory to Azure Active Directory. The security team requires that password hashes are synchronized but also that users can sign in using their on-premises credentials when connected to the corporate network. What authentication method should be configured in Azure AD Connect to meet these requirements?
- APass-through Authentication (PTA)
- BCloud-only user authentication
- CPassword Hash Synchronization (PHS)
- DFederation with AD FS (Active Directory Federation Services)
Show answer & explanationAnswer & explanation
Correct answer: A. Pass-through Authentication (PTA)
Pass-through Authentication (PTA) allows users to sign in with the same passwords on-premises and in the cloud. It validates user credentials directly against the on-premises Active Directory, satisfying the requirement for on-premises sign-in. It also supports Password Hash Synchronization (PHS) as a backup.
Why the other options are wrong
- B. Cloud-only user authentication is for users created directly in Azure AD and doesn't involve on-premises AD synchronization.
- C. PHS synchronizes hashes but doesn't allow direct on-premises validation for sign-in when connected to the corporate network.
- D. Federation with AD FS allows on-premises sign-in but doesn't directly synchronize password hashes to Azure AD for cloud authentication (it relies on redirecting to AD FS).
Azure AD Pass-through Authentication (PTA)
An Azure AD Connect authentication method that validates user passwords directly against the on-premises Active Directory when users try to sign in to Azure AD.
- Provides a simple password validation method for hybrid identities.
- Requires Lightweight Directory Access Protocol (LDAP) connectivity to domain controllers.
- Can be combined with Password Hash Synchronization (PHS) for redundancy.
Memory trick: Hybrid authentication: On-premise keys unlock cloud doors.