nerdexam
Microsoft

AZ-500 · Question #354

You have a Microsoft 365 tenant that uses an Azure Active Directory (Azure AD) tenant. The Azure AD tenant syncs to an on-premises Active Directory domain by using an instance of Azure AD Connect…

The correct answer is A. Change the Azure AD tenant used by the new subscription. To enable synced on-premises user accounts to be assigned roles in a new Azure subscription, the subscription must be associated with the Azure AD tenant containing those users.

Submitted by rachelw· Mar 6, 2026Secure identity and access

Question

You have a Microsoft 365 tenant that uses an Azure Active Directory (Azure AD) tenant. The Azure AD tenant syncs to an on-premises Active Directory domain by using an instance of Azure AD Connect. You create a new Azure subscription You discover that the synced on-premises user accounts cannot be assigned rotes in the new subscription. You need to ensure that you can assign Azure and Microsoft 365 roles to the synced Azure AD user accounts. What should you do first?

Options

  • AChange the Azure AD tenant used by the new subscription.
  • BConfigure the Azure AD tenant used by the new subscription to use pass-through authenticate
  • CConfigure the Azure AD tenant used by the new subscription to use federated authentication.
  • DConfigure a second instance of Azure AD Connect.

How the community answered

(49 responses)
  • A
    78% (38)
  • B
    6% (3)
  • C
    14% (7)
  • D
    2% (1)

Why each option

To enable synced on-premises user accounts to be assigned roles in a new Azure subscription, the subscription must be associated with the Azure AD tenant containing those users.

AChange the Azure AD tenant used by the new subscription.Correct

Azure subscriptions are implicitly trusted by a single Azure AD tenant, which governs identity and access for resources within that subscription. If a new subscription is created and linked to a different, isolated Azure AD tenant, the existing synced user accounts from the original tenant will not be present and thus cannot be assigned roles. Changing the new subscription's directory to the existing Azure AD tenant where the synced users reside will make them available for role assignments.

BConfigure the Azure AD tenant used by the new subscription to use pass-through authenticate

Pass-through authentication is a method for user sign-in and does not control which Azure AD tenant an Azure subscription is associated with or which user accounts are present within a tenant.

CConfigure the Azure AD tenant used by the new subscription to use federated authentication.

Federated authentication (like ADFS) is a method for user sign-in and does not control which Azure AD tenant an Azure subscription is associated with or which user accounts are present within a tenant.

DConfigure a second instance of Azure AD Connect.

Configuring a second instance of Azure AD Connect would attempt to sync another on-premises AD to another Azure AD tenant, or potentially the same, but it wouldn't resolve the issue of the new subscription being associated with the wrong Azure AD tenant.

Concept tested: Associating Azure subscriptions with Azure AD tenants

Source: https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-how-subscriptions-associated-directory

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-500 Practice