Venture into the world of Azure Infrastructure, where design meets functionality. Harness your skills and gain mastery over complex cloud structures to ace the AZ-305 Designing Microsoft Azure Infrastructure Solutions exam!
Gauge your current knowledge
Gauge your current knowledge
When designing access to on-premises resources, choosing the right authentication method depends on security requirements and infrastructure complexity. Password Hash Synchronization (PHS) synchronizes a cryptographic hash of user passwords from on-premises Active Directory to Microsoft Entra ID, enabling authentication to occur entirely in the cloud. Conversely, Pass-through Authentication (PTA) relies on an on-premises PTA agent to validate credentials directly against your on-premises domain controller, keeping password validation local without storing hashes in the cloud. Active Directory Federation Services (AD FS) redirects authentication requests directly to on-premises federation servers, providing advanced sign-on controls but requiring the most complex on-premises infrastructure.
Azure AD Connect acts as the primary integration engine that synchronizes user accounts, groups, and credential states from on-premises environments to the cloud. This synchronization engine establishes a dependency where changes in the on-premises directory propagate up to Microsoft Entra ID. When implementing PHS, the synchronization process runs on a recurring cycle to update password hashes in the cloud database. PTA and AD FS bypass cloud-based credential storage during synchronization, acting instead as trust boundaries where Microsoft Entra ID hands off authentication verification to local systems.
Microsoft Entra Application Proxy publishes on-premises web applications to external users without opening inbound firewall ports or using a virtual private network (VPN). The request flow begins when an external user requests the application, which Microsoft Entra ID authenticates and passes through a secure cloud endpoint. The on-premises Application Proxy connector polls the cloud service for requests, retrieves them over an outbound connection, and forwards them to the internal web server. For organizations using existing security appliances, Microsoft Entra ID integrates with Secure Hybrid Access partners like F5 BIG-IP and Zscaler to extend cloud-based identity protections to legacy traffic. To achieve seamless single sign-on for legacy systems, the connector or partner appliance can use certificate-based Kerberos constrained delegation (KCD) to safely impersonate the authenticated user to local resources.
Conditional Access acts as the policy decision point that evaluates signals before granting access to published on-premises applications. These policies apply strict controls based on user identity, group membership, device compliance, and geographical location. If a user attempts to access an on-premises application through the Application Proxy, the system can enforce multifactor authentication (MFA) or block access from unmanaged devices. This creates a secure boundary where access is continuously evaluated, ensuring that only trusted users on compliant devices can reach internal corporate resources.
StudyCerts
StudyCerts