AZ-305 Practice Question 2: Hybrid Authentication Resilience
Microsoft Azure Solutions Architect Expert (AZ-305) · Test 1 · question 2 of 10
A manufacturer authenticates its 9,000 Microsoft 365 users through an on-premises Active Directory Federation Services (AD FS) farm. After a ransomware incident took the on-premises datacenter offline for six days, the CIO sets these requirements for the redesigned identity solution:
- Users must keep signing in with their existing on-premises Active Directory passwords. - Cloud sign-in must keep working even when every on-premises server is unavailable. - Microsoft Entra ID Protection must report users with leaked credentials. - The on-premises server footprint must be as small as possible.
Which authentication method should you recommend?
Show answer and explanation
Answer:
With password hash synchronization (PHS), a hash of the on-premises password hash is synchronized to Microsoft Entra ID and credential validation happens entirely in the cloud. No on-premises component participates in a sign-in, so users keep working through a total on-premises outage; Microsoft explicitly calls this out as the "on-premises outage survival" argument for PHS. PHS is also the prerequisite for the Microsoft Entra ID Protection leaked-credentials report, and it requires the least infrastructure of the three methods. Seamless SSO removes password prompts on domain-joined devices.
Option A keeps sign-in dependent on on-premises infrastructure. A second farm improves availability against a single-site failure, but it doubles the largest on-premises footprint of any option and still leaves cloud sign-in tied to servers the attacker can reach.
Option C also fails the outage requirement. Pass-through authentication agents validate passwords against on-premises domain controllers, so an on-premises outage stops sign-ins. Failing over to PHS is possible but is a manual switch, and it only works if PHS was already configured before the failure.
Option D breaks the first requirement. Cloud-only identities are not associated with on-premises accounts, so users would need new cloud passwords and the on-premises directory would no longer be the source of truth, a far larger change than the scenario calls for.
Reference: Choose the right authentication method for your Microsoft Entra hybrid identity solution