Microsoft Azure Security Technologies (AZ-500)

Is recommending federation with AD FS a suitable solution for syncing user accounts with integrated password policies?

1. Yes

2. No

3. Depends on the environment

4. Yes, if integrated with Azure AD

The correct answer is: No

Federation with Active Directory Federation Services (AD FS) can indeed provide certain advantages when working with user accounts and authentication in environments that require single sign-on (SSO) solutions. However, recommending it as a suitable solution for syncing user accounts specifically with integrated password policies may not be the best approach. AD FS is primarily focused on providing a way to authenticate users across different domains and applications without requiring them to log in multiple times. While it does enable seamless authentication, it does not inherently sync user accounts in the same way that Azure AD Connect does. Azure AD Connect is the tool typically used to sync on-premises Active Directory user accounts to Azure Active Directory, ensuring that both environments can hold consistent user identity data. Moreover, when considering integrated password policies, it's important to understand that password policies can be managed directly within Azure Active Directory or through on-premises Active Directory. AD FS will not directly manage or enforce password policies across these accounts. For solutions focusing on integrating on-premises identity management with Azure AD while maintaining consistent password policies, using Azure AD Connect is generally the recommended approach. The reasons behind this conclude that simply recommending federation with AD FS doesn't fully address the needs for syncing user accounts with integrated password policies, as AD FS does not provide