Microsoft Certified: Azure Security Engineer AssociateManage identity and accessMedium
A client organization uses Azure AD Connect to synchronize user identities from its on-premises Active Directory to Azure AD. They are concerned about accidentally deleting a large number of user accounts from Azure AD if a misconfiguration or malicious activity occurs on the on-premises directory. They want a safeguard that prevents such bulk deletions from immediately propagating to Azure AD, providing a window to detect and remediate the issue. Which feature of Azure AD Connect should be configured?
- APrevent accidental deletions
- BStaging Mode
- CPassword Hash Synchronization (PHS)
- DAzure AD Connect Health
Show answer & explanationAnswer & explanation
Correct answer: A. Prevent accidental deletions
The 'Prevent accidental deletions' feature in Azure AD Connect is specifically designed to stop synchronization if a large number of deletions (exceeding a configured threshold) are detected, providing a safety net against unintended data loss.
Why the other options are wrong
- B. Staging mode allows you to test synchronization changes without exporting them to Azure AD, but it's not a direct protection against accidental deletions during normal operation.
- C. PHS is an authentication method and does not prevent accidental deletions.
- D. Azure AD Connect Health monitors the health of your sync services but does not prevent accidental deletions itself.
Azure AD Connect: Prevent Accidental Deletions
This feature in Azure AD Connect is a safeguard that prevents the synchronization of an excessive number of deletions from the on-premises directory to Azure AD. It halts the sync process if the number of detected deletions exceeds a configurable threshold, requiring administrator approval to proceed.
- Protects against unintended bulk user/object deletions.
- Configurable threshold for the number of deletions.
- Requires manual approval if the threshold is exceeded.
- Essential for maintaining data integrity in hybrid environments.
Memory trick: Don't Delete, Delay and Decide.