SC-300 Certification Practice Question #103

Question

Your on-premises network contains an Active Directory domain that uses Microsoft Entra Connect sync to sync with a Microsoft Entra tenant.

You need to configure Microsoft Entra Connect sync to meet the following requirements:

•	Microsoft Entra sign-ins must be authenticated by an Active Directory domain controller.
•	Active Directory domain users must be able to use Microsoft Entra self-service password reset (SSPR).
•	Minimize administrative effort.

What should you use for each requirement? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

Two requirements must both hold while minimizing effort. To have sign-ins authenticated by an on-premises domain controller, the choices are Federation (AD FS) or Pass-through authentication — PHS authenticates the hash in the cloud, not against a DC. Between AD FS and PTA, PTA needs only a lightweight agent (no AD FS farm, no certificates), so it satisfies "minimize administrative effort." For SSPR to flow back to on-premises AD, Microsoft Entra Connect must have Password writeback enabled; Device writeback, Group writeback, and Password hash synchronization do not write SSPR changes back to AD. MS Learn explicitly states password writeback synchronizes the changed credential back to on-prem AD DS, and works for federated, PHS, and PTA users. Both selections are unambiguous per MS Learn, hence high confidence.

More SC-300 practice questions