Your network contains an on-premises Active Directory Domain Services (AD DS) domain that syncs user accounts with a Microsoft 365 E5 subscription. You need to ensure that on-premises account…

Question

Options

• AAzure Active Directory Seamless Single Sign-on (Azure AD Seamless SSO)
• BMicrosoft Entra Cloud Sync
• Cpassword hash synchronization
• Dpass-through authentication

• A
  12% (5)
• B
  5% (2)
• C
  2% (1)
• D
  81% (34)

Explanation

Pass-through authentication (PTA) is correct because it validates user credentials directly against the on-premises AD DS in real time. When a user signs into Microsoft Entra ID, the authentication request is forwarded to an on-premises agent, which checks the credentials - and crucially, enforces on-premises policies like account lockout - before returning a pass/fail result.

Why the distractors are wrong:

• A (Seamless SSO): This silently signs in users already logged into domain-joined machines; it doesn't enforce on-premises lockout policies for cloud sign-ins.
• B (Microsoft Entra Cloud Sync): This is a synchronization tool for identities (replacing older AD Connect features); it doesn't handle authentication routing.
• C (Password Hash Synchronization): PHS copies a hash of the password hash to the cloud and authenticates users in the cloud, meaning on-premises lockout policies are bypassed - authentication never touches the on-premises AD.

Memory tip: Think of Pass-Through Authentication as a "live call" back to your on-premises AD - because the call goes through on-premises, all on-premises rules (including lockouts) apply. Password Hash Sync, by contrast, is a "recorded message" stored in the cloud, so on-premises rules don't apply.

No community discussion yet for this question.