nerdexam
Microsoft

MS-900 · Question #32

Drag and Drop Question An organization plans to deploy Microsoft 365 in a hybrid scenario. You need to provide a recommendation based on some common identity and access management scenarios. The solut

The correct answer is Active Directory Federation Services (AD FS); Password hash synchronization with single sign-on; Pass-through authentication and single sign-on. The three correct solutions address hybrid identity scenarios while minimizing costs. AD FS is used when organizations require advanced federation capabilities or compliance requirements that necessitate on-premises token issuance. Password hash synchronization with SSO is the si

Submitted by mateo_ar· Mar 5, 2026Implement and manage identity and access in Microsoft 365 hybrid environments, specifically evaluating authentication methods (AD FS, Password Hash Sync, Pass-through Authentication) to meet organizational requirements while minimizing cost.

Question

Drag and Drop Question An organization plans to deploy Microsoft 365 in a hybrid scenario. You need to provide a recommendation based on some common identity and access management scenarios. The solution must minimize costs. Match each solution to its appropriate scenario. To answer, drag the appropriate solutions from the column on the left to the scenarios on the right. Each solution may be used once, more than once, or not at all. Each correct match is worth one point. NOTE: Each correct selection is worth one point. Answer:

Exhibit

MS-900 question #32 exhibit

Answer Area

Drag items

Active Directory Federation Services (AD FS)PingFederate and federation integrationPassword hash synchronization with single sign-onPass-through authentication and single sign-on

Correct arrangement

  • Active Directory Federation Services (AD FS)
  • Password hash synchronization with single sign-on
  • Pass-through authentication and single sign-on

Explanation

The three correct solutions address hybrid identity scenarios while minimizing costs. AD FS is used when organizations require advanced federation capabilities or compliance requirements that necessitate on-premises token issuance. Password hash synchronization with SSO is the simplest and lowest-cost option, syncing password hashes to Azure AD for cloud-based authentication without requiring on-premises infrastructure for authentication. Pass-through authentication with SSO validates passwords directly against on-premises AD in real-time without storing hashes in the cloud, ideal for organizations with security policies that prohibit cloud-stored password hashes but want to avoid the complexity of AD FS.

Topics

#Hybrid Identity#Azure AD Connect#Single Sign-On#Identity and Access Management

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full MS-900 Practice