Question
Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com.
You have a Microsoft Entra tenant.
You need to implement Microsoft Entra Connect Sync. The solution must meet the following requirements:
• Prevent the password hashes of contoso.com from being synced to the Microsoft Entra tenant.
• Minimize user effort when authenticating to Microsoft Entra registered apps.
• Minimize the number of on-premises infrastructure components.
What should you include in the solution for each requirement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation
Prevent contoso.com password hashes from being synced to the tenant: Pass-through authentication — With pass-through authentication (PTA), Microsoft Entra Connect Sync synchronizes only directory objects and attributes; the password validation is handed off to a lightweight PTA agent that checks the credential directly against an on-premises domain controller, so no password hashes ever leave contoso.com. Password hash synchronization is exactly what the requirement forbids, and while AD FS federation would also keep hashes on-premises, it requires a whole federation server and web application proxy farm, which conflicts with minimizing on-premises infrastructure — PTA only needs an agent (which can even run on the Entra Connect server itself).
Minimize user effort when authenticating to Microsoft Entra registered apps: Single sign-on (SSO) — Microsoft Entra seamless single sign-on is the companion feature to pass-through authentication: domain-joined machines on the corporate network get a Kerberos ticket for the Entra service and are signed in to Entra-integrated apps automatically, without the user retyping a password. It is enabled as an option in Microsoft Entra Connect and adds only a computer account (AZUREADSSOACC) in AD DS, so unlike AD FS it delivers the seamless sign-in experience without deploying additional on-premises servers.
