Exam MS-100 topic 4 question 34 discussion

Answer: B D Explanation When you choose this federation as the authentication method, Azure AD hands off the authentication process to a separate trusted authentication system, such as on-premises Active Directory Federation Services (AD FS), to validate the user's password. AD FS can use on-premises Active Directory as an authentication provider. AD FS can also provide SSO when using Active Directory as an authentication provider.

The only possible answer is B and D. A is obviously wrong as with federation you need more infrastructure compared to other authentication methods. C is another very wrong option as with federation authentication Azure AD hands off everything to the authentication agent installed on-premise. Answer is correct: B D

ADFS offers kerberos SSO, seamless SSO is hybrid functionality offered with PHS or PtA. But this is probably just a typo.

It must be typo as adfs don't support Seamless SSO, just regular SSO based on kerberos.

I don't understand the question and answer options

Correct Answer: B, D When you choose this federation as the authentication method, Azure AD hands off the authentication process to a separate trusted authentication system, such as on-premises Active Directory Federation Services (AD FS), to validate the user's password. AD FS can use on-premise Active Directory as an authentication provider. AD FS can also provide SSO when using Active Directory as an authentication provider. Incorrect Answers: A: Additional servers are required to support the AD FS infrastructure. C: The passwords are not synchronized to Azure AD. (Require agents on-premise DC) Password synchronization – Utilizes the password change notification service (PCNS) to capture password changes from Active Directory and propagate them to other connected data sources. Reference: https://docs.microsoft.com/en-us/azure/security/azure-ad-choose-authn https://samilamppu.com/2019/01/04/from-adfs-to-password-hash-sync-and-seamless-sso/ https://docs.microsoft.com/en-us/microsoft-identity-manager/infrastructure/mim2016-password-management

Two answers required. A&C are out.

B & D for sure!

https://docs.microsoft.com/en-us/office365/troubleshoot/active-directory/set-up-adfs-for-single-sign-on B is correct

Seamless SSO can be combined with either the Password Hash Synchronization or Pass-through Authentication sign-in methods. Seamless SSO is not applicable to Active Directory Federation Services (ADFS). https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso