Cloud · Microsoft Azure · Certifications
AZ-500: AD FS federation and server minimization
Select one answer. Your result and the explanation will appear immediately.
Question 16
Your organization plans to integrate an on-premises Active Directory domain named weylandindustries.com with an Azure AD tenant of the same name. The integration must enforce on-premises password policies and user logon restrictions while minimizing the number of additional servers required. You propose using Azure AD Connect with federation via Active Directory Federation Services (AD FS). Does this solution meet these requirements?
Correct answer: No, it enforces on-premises policies but increases the number of servers needed.
AD FS federation redirects cloud authentication to the on-premises identity infrastructure, so on-premises password policies and logon restrictions can be enforced. However, AD FS requires federation servers and typically Web Application Proxy servers for external access and high availability, increasing the on-premises server footprint.
Exam clue: Federation is strong when sign-ins must be evaluated by on-premises AD, but the wording “minimizing the number of additional servers” conflicts with the infrastructure required by AD FS.
Remember: AD FS provides federation and on-premises policy enforcement, but adds server infrastructure. Password hash synchronization is usually the simplest hybrid option when minimizing infrastructure is important.