Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Kerberos and NTLM Authentication Without Domain Controllers
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An organization is migrating a legacy line-of-business application from an on-premises datacenter to Azure Virtual Machines.
The application has the following technical requirements:
- Must authenticate users using traditional Kerberos or NTLM protocols
- Virtual machines must support domain join and Group Policy management
- The IT team wants to avoid deploying, managing, or patching dedicated Windows Server domain controllers in the cloud
Which identity service should the organization implement to meet these requirements?
Explanations
Microsoft Entra Domain Services
Microsoft Entra Domain Services
What Microsoft Entra Domain Services Is
Microsoft Entra Domain Services provides managed domain services such as domain join, Group Policy, Lightweight Directory Access Protocol (LDAP), and Kerberos/NTLM authentication. It enables organizations to run legacy applications in the cloud without requiring administrators to deploy, configure, backup, and patch traditional Windows Server domain controllers (DCs).
How It Meets the Requirements
- Legacy Protocol Support: It offers native support for legacy authentication protocols such as Kerberos and NTLM, allowing lifted applications to function without code modifications.
- Virtual Machine Domain Join: Azure Virtual Machines can be directly joined to the managed domain to receive centralized Group Policy objects.
- Zero Domain Controller Management: The underlying domain controllers are fully managed and maintained by the Azure platform, removing administrative maintenance overhead.
Key Advantages and Capabilities
- One-way synchronization automatically replicates user accounts, group memberships, and credentials from Microsoft Entra ID.
- Lift-and-shift compatibility allows migration of traditional directory-aware applications to Azure.
- High availability is built-in with replica sets across Azure regions without manual replication configuration.
- Secure LDAP (LDAPS) and DNS management are natively supported.
Why This Is Optimal
Microsoft Entra Domain Services is the ideal solution because standard Microsoft Entra ID relies on modern web-based authentication protocols (OAuth 2.0, OpenID Connect, SAML) and does not natively support Kerberos/NTLM or traditional machine domain joining.
Microsoft Entra ID Protection
Microsoft Entra ID Protection
What Microsoft Entra ID Protection Is
Microsoft Entra ID Protection is a security tool available with Microsoft Entra ID P2 licenses that detects, investigates, and remediates identity-based risks across an organization's directory.
Why It Doesn't Meet the Requirement
Microsoft Entra ID Protection focuses on analyzing user risk and sign-in risk using machine learning and threat intelligence. It is not an identity directory service and cannot perform domain joins, execute Group Policy, or provide Kerberos/NTLM authentication for virtual machines.
Key Characteristics and Limitations
- Evaluates real-time signals to detect compromised user credentials and anomalous sign-in behaviors.
- Integrates with Conditional Access to automate risk-based remediation policies, such as enforcing multi-factor authentication or password resets.
- Does not provide directory infrastructure or manage cloud virtual machines.
This Answer Would Be Correct If
This option would be correct if the scenario required identifying suspicious sign-ins, detecting leaked employee credentials, or configuring risk-based automated remediation.
Microsoft Entra External ID
Microsoft Entra External ID
What Microsoft Entra External ID Is
Microsoft Entra External ID is an identity solution designed for Business-to-Business (B2B) collaboration and Customer Identity and Access Management (CIAM).
Why It Doesn't Meet the Requirement
Microsoft Entra External ID is tailored for managing how guest users, external partners, and consumers interact with consumer-facing web or mobile applications. It does not provide domain management services, Kerberos/NTLM endpoints, or Group Policy capabilities for internal Azure Virtual Machines.
Key Characteristics and Limitations
- Enables guest access and secure sharing of applications with external partners.
- Allows consumer self-service registration using social accounts (e.g., Google, Facebook) or one-time passcodes.
- Operates entirely on modern web protocols and does not facilitate enterprise virtual machine domain joins.
This Answer Would Be Correct If
This option would be correct if the organization needed to allow external suppliers or consumers to authenticate to a public-facing web portal using social accounts or email passcodes.
Microsoft Entra Cloud Sync
Microsoft Entra Cloud Sync
What Microsoft Entra Cloud Sync Is
Microsoft Entra Cloud Sync is a lightweight synchronization offering designed to bridge on-premises Active Directory Domain Services (AD DS) directories with Microsoft Entra ID.
Why It Doesn't Meet the Requirement
While Microsoft Entra Cloud Sync synchronizes users, groups, and contact objects from on-premises domains to the cloud, it is strictly a synchronization mechanism. It does not provide a managed domain in Azure for virtual machines to join, nor does it host Kerberos authentication services or Group Policy management.
Key Characteristics and Limitations
- Uses lightweight on-premises agents to synchronize identity data to Microsoft Entra ID.
- Simplifies management for multi-forest and disconnected on-premises Active Directory environments.
- Does not eliminate the need for domain controllers if legacy authentication is required in cloud-hosted workloads.
This Answer Would Be Correct If
This option would be correct if the primary objective was synchronizing on-premises Active Directory user accounts to Microsoft Entra ID using a lightweight agent architecture.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Entra ID Protection
Describe directory services in Azure, including Microsoft Entra ID and Microsoft Entra Domain Services
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Conditional Access
Describe directory services in Azure, including Microsoft Entra ID and Microsoft Entra Domain Services
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Entra ID (Azure Active Directory)
Describe directory services in Azure, including Microsoft Entra ID and Microsoft Entra Domain Services
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Entra Domain Services Managed Domain
Describe directory services in Azure, including Microsoft Entra ID and Microsoft Entra Domain Services
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Availability Zones Fault Isolation
Describe availability zones
IntermediateAZ-800 Administering Windows Server Hybrid Core Infrastructure Exam
Azure File Sync Event Logs and Azure Monitor
Configure and manage Azure File Sync
Last updated Validated