Cloud · Microsoft Azure · Certifications
AZ-500: Hybrid authentication method
Select one answer. Your result and the explanation will appear immediately.
Question 1
You are designing an identity solution for a company with an on-premises Active Directory forest, corp.local, and an Azure AD tenant, contoso.onmicrosoft.com. The solution must enforce on-premises password policies, minimise servers, and provide seamless sign-on to cloud apps on corporate devices. Which authentication method should you choose?
Correct answer: Use password hash synchronization with Seamless SSO.
Password hash synchronization keeps on-premises Active Directory as the password-policy authority while synchronizing password hashes to Microsoft Entra ID. Seamless SSO automatically signs in users on domain-joined corporate devices. It is the lowest-infrastructure option because cloud sign-ins do not need AD FS servers or pass-through authentication agents.
Exam clue: “Minimise servers” together with “seamless sign-on on corporate devices” points to password hash synchronization with Seamless SSO.
Remember: Choose password hash synchronization for the simplest hybrid authentication setup. Choose pass-through authentication only when cloud sign-ins must be validated directly against on-premises Active Directory, and federation only for a specific federation requirement.