Hotspot Question You have a Microsoft 365 tenant and an Active Directory domain named adatum.com. You deploy Azure AD Connect by using the Express Settings. You need to configure self-service…

Question

Answer Area

• From the Password reset blade in the Azure Active Directory admin center, configure:Authentication methods
  Authentication methodsNotificationsPropertiesRegistration
• From Azure AD Connect, enable:Password writeback
  Federation with Active Directory Federation Services (AD FS)Pass-through authenticationPassword hash synchronizationPassword writeback

• Notifications|Federation with Active Directory Federation Services (AD FS)
  100% (1)

Explanation

This hotspot question tests knowledge of configuring Self-Service Password Reset (SSPR) authentication methods and password writeback in Azure AD Connect for a hybrid environment.

Approach. For the authentication methods requirement, you must set the number of methods required to reset to 2, and enable both 'Mobile app notification' and 'Security questions' as allowed methods, with the number of security questions required to register and answer set to 3. This satisfies the 'mobile app notification OR three security questions' requirement. For password synchronization in both directions (cloud-to-on-premises and on-premises-to-cloud), you must enable Password Writeback in Azure AD Connect - this allows passwords reset in the cloud via SSPR to be written back to the on-premises Active Directory. Password Hash Synchronization (already enabled via Express Settings) handles on-premises-to-cloud sync, while Password Writeback handles cloud-to-on-premises sync.

Concept tested. The question tests two hybrid identity concepts: (1) SSPR authentication method configuration - specifically setting the number of required methods to 1 and selecting 'Mobile app notification' and 'Security questions (3 required)' so users are presented with either option; and (2) Password Writeback configuration in Azure AD Connect, which is required to sync password resets made in Azure AD back to on-premises Active Directory. Without Password Writeback, passwords reset via SSPR in the cloud would not propagate to the on-premises domain.

Reference. https://learn.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-sspr-writeback

No community discussion yet for this question.