SC-300 Certification Practice Question #157

Question

Your network contains an on-premises Active Directory Domain Services (AD DS) domain that syncs user accounts with a Microsoft 365 E5 subscription.

You need to ensure that on-premises account lockout policies are applied to Microsoft Entra sign-ins.

What should you configure?

Accepted Answer

To have on-premises AD DS account lockout policies enforced on Entra sign-ins, authentication must occur against on-premises AD rather than in the cloud. Pass-through authentication (PTA) does exactly that — Entra forwards the credential to an on-premises agent that validates it directly against AD DS, so AD's account lockout (and other password) policies apply at sign-in. Password hash synchronization (C) authenticates in the cloud against synchronized hashes, so on-premises lockout policies are not evaluated; Seamless SSO (A) is a convenience layer over PHS/PTA, not an authentication method; and Cloud Sync (B) only provisions objects. The official Suggested Answer, the unanimous community vote (4), and the 3-👍 explanation all agree with MS Learn, hence high confidence.

More SC-300 practice questions