Microsoft Certified: Identity and Access Administrator AssociateImplement an identity management solutionMedium
A company is setting up Azure AD Connect with Password Hash Synchronization (PHS). During the initial synchronization, they observe that some user accounts are not synchronizing from on-premises Active Directory to Azure AD. Upon investigation, they find that the `userPrincipalName` attribute for these users is missing or improperly formatted in the on-premises AD. What is the most likely reason for these accounts failing to synchronize with PHS?
- APHS requires the UPN to be identical to the primary SMTP address.
- BThe `userPrincipalName` attribute is a mandatory attribute for synchronization to Azure AD.
- CThe `userPrincipalName` attribute is only required for Pass-through Authentication (PTA), not PHS.
- DThe `userPrincipalName` attribute is used for group synchronization, not user synchronization.
Show answer & explanationAnswer & explanation
Correct answer: B. The `userPrincipalName` attribute is a mandatory attribute for synchronization to Azure AD.
The `userPrincipalName` attribute is a mandatory attribute for user synchronization to Azure AD. If it's missing or improperly formatted, the synchronization process for those specific user objects will fail.
Why the other options are wrong
- A. While it's a best practice, UPN and primary SMTP don't need to be identical for PHS to function.
- C. UPN is critical for both PHS and PTA for user sign-in and identity uniqueness.
- D. UPN is primarily for user identity and sign-in, while group synchronization relies on other attributes like `sAMAccountName` and `objectGUID`.
Azure AD Connect Mandatory Attributes
Certain attributes are mandatory for user objects to be successfully synchronized from on-premises Active Directory to Azure AD, including `userPrincipalName`, `sAMAccountName`, and `objectGUID`.
- Missing mandatory attributes cause synchronization failures.
- `userPrincipalName` is crucial for sign-in and uniqueness.
- Errors are reported in Azure AD Connect Health.
Memory trick: Mandatory attributes are the 'must-haves' for identities to cross the bridge.