Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Managed Domain Services for Legacy Applications on Azure
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An organization is migrating several legacy enterprise applications to Azure Virtual Machines as part of a lift-and-shift migration. These legacy applications require traditional directory features, including Kerberos authentication, LDAP directory lookups, and Group Policy management, but the IT team wants to avoid the administrative overhead of deploying, managing, and patching dedicated domain controller virtual machines in the cloud.
Which identity service should the organization deploy to meet these requirements?
Explanations
Microsoft Entra Application Proxy
Microsoft Entra Application Proxy
What Microsoft Entra Application Proxy Is
Microsoft Entra Application Proxy is a feature of Microsoft Entra ID that provides secure remote access to internal, on-premises web applications without requiring a virtual private network (VPN) or demilitarized zone (DMZ).
Why It Doesn't Meet the Requirement
Application Proxy is designed to publish on-premises web applications to external remote users via cloud endpoints. It does not provide domain management services, does not allow Azure virtual machines to join a domain, and does not provide managed LDAP or Group Policy services for cloud-hosted workloads.
Key Characteristics and Limitations
- Reverse Proxy Architecture: Acts as a secure gateway for publishing internal HTTP/HTTPS and Integrated Windows Authentication (IWA) web apps.
- Connector-Based: Relies on lightweight connector agents installed in the local network.
- Not a Directory Service: Does not host an Active Directory domain or manage infrastructure virtual machines.
This Answer Would Be Correct If
The requirement was to publish internal, on-premises web applications to remote employees over the internet without setting up a traditional VPN connection.
Microsoft Entra Connect
Microsoft Entra Connect
What Microsoft Entra Connect Is
Microsoft Entra Connect is an on-premises software application and synchronization bridge that integrates on-premises Active Directory Domain Services (AD DS) environments with Microsoft Entra ID.
Why It Doesn't Meet the Requirement
Microsoft Entra Connect is a synchronization tool rather than an identity provider or domain service. While it synchronizes identity data (such as users, groups, and password hashes) between on-premises Active Directory and the cloud, it does not provide domain controller functionality, LDAP endpoints, Kerberos ticket granting, or Group Policy management for Azure VMs.
Key Characteristics and Limitations
- Synchronization Tool: Its primary role is provisioning and matching identity objects across hybrid environments.
- Requires On-Premises Hosting: It is installed on an on-premises Windows Server and manages synchronization schedules.
- No Direct Authentication Endpoints: It does not host managed domain endpoints or serve Kerberos tickets directly to cloud-hosted VMs.
This Answer Would Be Correct If
The scenario focused on synchronizing existing on-premises Active Directory user accounts, security groups, and password hashes into Microsoft Entra ID to establish a hybrid identity foundation.
Microsoft Entra ID
Microsoft Entra ID
What Microsoft Entra ID Is
Microsoft Entra ID (formerly Azure Active Directory) is a cloud-based identity and access management service designed for web-based, cloud-native applications and software-as-a-service (SaaS) platforms.
Why It Doesn't Meet the Requirement
Microsoft Entra ID relies on modern internet-scale authentication protocols such as OpenID Connect, OAuth 2.0, SAML 2.0, and WS-Federation. It does not natively support legacy protocols such as Kerberos, NTLM, or direct LDAP queries, nor does it support traditional Active Directory Group Policy for virtual machine configuration.
Key Characteristics and Limitations
- Protocol Focus: Designed specifically for modern HTTP/HTTPS-based authentication protocols rather than RPC or LDAP.
- Flat Structure: Does not use traditional hierarchical Organizational Units (OUs) or Active Directory schema.
- No Native Kerberos/NTLM: Legacy applications requiring Kerberos tickets or NTLM challenge-response cannot authenticate directly against Microsoft Entra ID without an intermediary service.
This Answer Would Be Correct If
The organization needed a cloud identity provider to enable single sign-on (SSO), multifactor authentication (MFA), and Conditional Access for modern web applications, Microsoft 365, or third-party SaaS services like Salesforce and ServiceNow.
Microsoft Entra Domain Services
Microsoft Entra Domain Services
What Microsoft Entra Domain Services Is
Microsoft Entra Domain Services provides managed domain services such as domain join, Group Policy, Lightweight Directory Access Protocol (LDAP/LDAPS), and Kerberos/NTLM authentication. It enables organizations to run legacy applications in the cloud without requiring administrators to deploy, configure, patch, or maintain traditional Active Directory Domain Services (AD DS) domain controllers.
How It Meets the Requirements
- Legacy Protocol Support: It natively provides legacy authentication protocols (Kerberos and NTLM) and directory access (LDAP) required by older workloads.
- Managed Infrastructure: The underlying domain controllers and replica sets are completely managed, updated, and secured by the Azure platform, eliminating manual patching and OS management.
- Group Policy & Domain Join: It allows Azure virtual machines to be domain-joined and centrally managed using standard Group Policy Objects (GPOs).
- Seamless Identity Synchronization: It performs a one-way synchronization of user accounts, group memberships, and credentials from Microsoft Entra ID, enabling users to sign in with their corporate credentials.
Key Advantages and Capabilities
- Zero Domain Controller Maintenance: Azure handles automated backups, patching, and disk encryption for the managed domain.
- Simplified Lift-and-Shift: Enables moving on-premises applications to Azure without rewriting authentication mechanisms.
- High Availability: Automatically provisions redundant domain controllers across availability zones or regions with replica sets.
- Hybrid & Cloud-Only Flexibility: Works identically whether the identity tenant is cloud-only or synchronized from an on-premises Active Directory.
Why This Is Optimal
Microsoft Entra Domain Services delivers full compatibility with traditional Active Directory protocols in a fully managed Platform as a Service (PaaS) model, making it the ideal choice for migrating legacy workloads without managing server infrastructure.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Entra ID Protection
Describe directory services in Azure, including Microsoft Entra ID and Microsoft Entra Domain Services
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Conditional Access
Describe directory services in Azure, including Microsoft Entra ID and Microsoft Entra Domain Services
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Entra ID (Azure Active Directory)
Describe directory services in Azure, including Microsoft Entra ID and Microsoft Entra Domain Services
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Entra Domain Services Legacy Authentication
Describe directory services in Azure, including Microsoft Entra ID and Microsoft Entra Domain Services
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Platform as a Service (PaaS)
Identify appropriate use cases for each cloud model
AdvancedAZ-104 Microsoft Azure Administrator Exam
Availability Zones High Availability
Deploy virtual machines to availability zones and availability sets
Last updated Validated