Azure Identity and Access Management Design Flashcards

Which Azure service allows you to extend your on-premises Active Directory domain to Azure virtual machines without deploying domain controllers?

Answer: Azure AD Domain Services

Azure AD Domain Services provides managed domain services (LDAP, Kerberos, NTLM) without requiring you to deploy, manage, or patch domain controllers.

You need to enforce that all administrator accounts in your organization use phishing-resistant MFA. Which Azure AD policy type should you configure?

Answer: Conditional Access policy with authentication strength

Conditional Access with Authentication Strength allows you to require specific MFA methods (e.g., FIDO2, Certificate-based) for privileged roles, enforcing phishing-resistant authentication.

What is the maximum number of objects that can be synchronized from on-premises AD to Azure AD Connect with a single Azure AD tenant?

Answer: No hard limit — scales to millions

Azure AD Connect has no fixed upper limit for the number of synchronized objects; the Azure AD tenant itself can hold up to 500,000 objects by default, expandable on request.

Which identity model allows users to sign in to Azure resources using the same credentials as their on-premises AD without password hash sync to Azure AD?

Answer: Federation with ADFS

Federation with ADFS redirects authentication to on-premises ADFS servers so credentials are validated locally and never sent to Azure AD, which is the model that avoids password hash sync.

Which Azure AD feature enables employees to request access packages containing multiple resource access rights (groups, apps, SharePoint) through a self-service portal?

Answer: Entitlement Management

Entitlement Management lets you bundle access to multiple resources into access packages that users can request through a governed, approval-based self-service portal.

A security architect wants to detect when Azure AD accounts are used from anonymous IP addresses or unfamiliar locations. Which feature provides this capability?

Answer: Azure AD Identity Protection risk detections

Azure AD Identity Protection automatically generates risk detections for suspicious sign-in patterns including anonymous proxies, atypical travel, and unfamiliar sign-in properties.