Hotspot Question You have a Microsoft Entra tenant that uses Microsoft Entra Connect Sync to sync with an on- premises Active Directory Domain Services (AD DS) domain. The domain contains several memb

This hotspot question tests knowledge of Microsoft Entra Identity Governance provisioning methods and how to provision users from an HR application (via CSV) into both AD DS and Microsoft Entra ID.

Submitted by satoshi_tk· Mar 6, 2026Design identity, governance, and monitoring solutions

Question

Hotspot Question You have a Microsoft Entra tenant that uses Microsoft Entra Connect Sync to sync with an on- premises Active Directory Domain Services (AD DS) domain. The domain contains several member servers. You have a custom human resources (HR) application named App1 that stores employee records. You are designing a solution to automate the management of user accounts. The solution must meet the following requirements: - When employees are added to App1, the user accounts of the employee1 must be provisioned to the AD DS domain and the Microsoft Entra tenant automatically. - New employee records must be read from a CSV file that is exported from App1 daily. You need to recommend a Microsoft Entra Identity Governance provisioning method and a target endpoint for creating new user accounts. What should you recommend? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Answer:

Exhibit

Answer Area

Identity Governance provisioning method:
API-driven inbound provisioningApplication provisioningThe Extensible Connectivity (ECMA) connector
Target endpoint:
An AD DS domain controllerThe Microsoft Entra Connect provisioning agentThe Microsoft Entra tenantAn SCIM endpoint

Explanation

This hotspot question tests knowledge of Microsoft Entra Identity Governance provisioning methods and how to provision users from an HR application (via CSV) into both AD DS and Microsoft Entra ID.

Approach. The correct provisioning method is 'HR-driven provisioning' using an 'API-driven provisioning' or more specifically 'CSV/file-based inbound provisioning' via Microsoft Entra ID Governance. Since the requirement states that new employee records must be read from a CSV file exported from App1 daily, the correct provisioning method is API-driven provisioning (specifically inbound provisioning from a CSV file using the /bulkUpload API endpoint or the provisioning agent with CSV support). The target endpoint for creating new user accounts should be Active Directory Domain Services (on-premises AD DS), because once accounts are provisioned to AD DS, Microsoft Entra Connect Sync will automatically sync them up to the Microsoft Entra tenant - satisfying the requirement that accounts appear in both AD DS and the Microsoft Entra tenant. The provisioning method recommended is 'API-driven provisioning' (HR-driven inbound provisioning reading from a CSV/flat file), and the target is 'Active Directory (on-premises)' so that Connect Sync propagates the accounts to Microsoft Entra ID automatically.

Concept tested. Microsoft Entra Identity Governance inbound HR provisioning - specifically using API-driven (CSV-based) inbound provisioning to write new user accounts to on-premises AD DS, then leveraging Microsoft Entra Connect Sync to synchronize those accounts to the Microsoft Entra tenant. Key distinction: provisioning to AD DS first (not directly to Entra ID) ensures both endpoints are populated via the existing Connect Sync pipeline.

Reference. https://learn.microsoft.com/en-us/entra/identity/app-provisioning/inbound-provisioning-api-concepts

Topics

#Microsoft Entra Connect Sync#Identity Governance#User provisioning#Active Directory

Community Discussion

No community discussion yet for this question.

Full AZ-305 Practice