Microsoft Certified: Azure Security Engineer AssociateManage identity and accessMedium

A client organization uses Azure AD Connect to synchronize user identities from its on-premises Active Directory to Azure AD. They are concerned about accidentally deleting a large number of user accounts from Azure AD if a misconfiguration or malicious activity occurs on the on-premises directory. They want a safeguard that prevents such bulk deletions from immediately propagating to Azure AD, providing a window to detect and remediate the issue. Which feature of Azure AD Connect should be configured?

  1. APrevent accidental deletions
  2. BStaging Mode
  3. CPassword Hash Synchronization (PHS)
  4. DAzure AD Connect Health
Show answer & explanation

Correct answer: A. Prevent accidental deletions

The 'Prevent accidental deletions' feature in Azure AD Connect is specifically designed to stop synchronization if a large number of deletions (exceeding a configured threshold) are detected, providing a safety net against unintended data loss.

Why the other options are wrong

  • B. Staging mode allows you to test synchronization changes without exporting them to Azure AD, but it's not a direct protection against accidental deletions during normal operation.
  • C. PHS is an authentication method and does not prevent accidental deletions.
  • D. Azure AD Connect Health monitors the health of your sync services but does not prevent accidental deletions itself.

Azure AD Connect: Prevent Accidental Deletions

This feature in Azure AD Connect is a safeguard that prevents the synchronization of an excessive number of deletions from the on-premises directory to Azure AD. It halts the sync process if the number of detected deletions exceeds a configurable threshold, requiring administrator approval to proceed.

  • Protects against unintended bulk user/object deletions.
  • Configurable threshold for the number of deletions.
  • Requires manual approval if the threshold is exceeded.
  • Essential for maintaining data integrity in hybrid environments.

Memory trick: Don't Delete, Delay and Decide.

More Manage identity and access questions