Question
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Active Directory forest that syncs to an Azure Active Directory (Azure AD) tenant.
You discover that when a user account is disabled in Active Directory, the disabled user can still authenticate to Azure AD for up to 30 minutes.
You need to ensure that when a user account is disabled in Active Directory, the user account is immediately prevented from authenticating to Azure AD.
Solution: You configure pass-through authentication.
Does this meet the goal?
- A. Yes Correct
- B. No
Explanation
With pass-through authentication, Azure AD hands each password sign-in to an on-premises agent that validates it directly against Active Directory. On-premises account states such as disabled, locked out or expired are therefore enforced at the moment of sign-in, without waiting for the next synchronization cycle. Password hash sync alone is what causes the delay described in the scenario.
