Question
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Active Directory forest that syncs to an Azure Active Directory (Azure AD) tenant.
You discover that when a user account is disabled in Active Directory, the disabled user can still authenticate to Azure AD for up to 30 minutes.
You need to ensure that when a user account is disabled in Active Directory, the user account is immediately prevented from authenticating to Azure AD.
Solution: You configure Azure AD Password Protection.
Does this meet the goal?
- A. Yes
- B. No Correct
Explanation
Azure AD Password Protection only blocks weak and banned passwords when passwords are set or changed; it has no effect on whether a disabled account can authenticate. The delay comes from password hash synchronization, where the disabled state reaches Azure AD only on the next sync cycle. To enforce the on-premises account state immediately, you would use pass-through authentication or federation so that sign-ins are validated against Active Directory in real time.
