Exam MS-102 topic 1 question 27 discussion

I Agree. As the local ADDS name is "contoso.local", we need to make some few steps/prerequisites before being able to set up account synchronization: -> Add a custom domain name on the Azure AD / MS Entra portal (ex. contoso.com) -> Add a local UPN suffix at the ADDS Forest level (contoso.com) -> Modify all user account UPN from [email protected] to [email protected] Then comes the Azure AD Connect deployment & the PTA configuration.

Real Question in exam

Basically a Pass-through Authentication Agent is installed on the same server as Microsoft Entra Connect. So there is no need to install it on a domain controller and also not a good security approach to install any agents apart from few exceptions like "Identity Protection" etc. For high availability we can install another authentication agent on any member server like server 2016 with TLS 1.2 enabled. Here is more info : https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-pta-quick-start

C / E / F Why the other options are not needed: A. Install an Authentication Agent on a domain controller – The first PTA agent is installed automatically on the Azure AD Connect server you’re already planning to deploy; extra agents on DCs are optional, not a prep requirement. B. Configure an authentication method in the Entra admin center – Refers to MFA/passwordless methods, which are independent of enabling PTA. D. Modify the email address attribute for each user account – The mail/SMTP address doesn’t affect PTA; authentication relies on the UPN, not the email attribute.

Definitly B,C,D is not answer. Answer is A,E,F

CHATGPT - Why not the other options? B. Configure an authentication method in Entra ID ❌ Authentication methods in Entra ID are for MFA, passwordless authentication, and SSPR, not PTA setup. D. Modify the email address attribute for each user account ❌ The email attribute (mail) is not used for authentication. Instead, UPN should match the verified domain. F. Modify the User logon name for each user account ❌ Changing User logon name (sAMAccountName) is not needed. You only need to update UPNs to match the verified domain.

A , B , E

A. From a domain controller, install an Authentication Agent. B. From the Microsoft Entra admin center, configure an authentication method. E. From the Microsoft Entra admin center, add a custom domain name https://learn.microsoft.com/pt-br/entra/identity/hybrid/connect/how-to-connect-pta-quick-start https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-pta-quick-start

the three most essential actions: A. From a domain controller, install an Authentication Agent. C. From Active Directory Domains and Trusts, add a UPN suffix. E. From the Microsoft Entra admin center, add a custom domain name.

CEF. You should not install Authetication Agent on a domain controller. You can, but you really should not.

To prepare your environment for implementing pass-through authentication with Azure AD Connect, you should perform the following actions: From a domain controller, install an Authentication Agent (Option A). This agent is necessary for pass-through authentication to work. From Active Directory Domains and Trusts, add a UPN suffix (Option C). This ensures that user principal names (UPNs) in your on-premises AD match the domain name in Azure AD. From the Microsoft Entra admin center, add a custom domain name (Option E). This allows users to sign in with their custom domain rather than the default onmicrosoft.com domain. These steps will help you set up the necessary components for pass-through authentication

Copilot answer ABE : To prepare the environment for implementing pass-through authentication, follow these steps: 1. Install an Authentication Agent: From a domain controller, install the Azure AD Connect Authentication Agent (also known as Microsoft Entra Connect) on a member server. This agent facilitates pass-through authentication by validating user passwords directly against the on-premises Active Directory1. Ensure that the server running the Authentication Agent is running Windows Server 2016 or later and has TLS 1.2 enabled. 2. Configure an Authentication Method: In the Microsoft Entra admin center, configure pass-through authentication as the authentication method for your Azure AD tenant. This allows users to sign in to both on-premises and cloud-based applications using the same passwords1. Specify the on-premises account for connectivity during the configuration process. 3. Add a Custom Domain Name: In the Microsoft Entra admin center, add one or more custom domain names to your Azure AD tenant. Users can sign in using these domain names1.

Option C (adding a UPN suffix) is not necessary for implementing pass-through authentication.

I`m going to say A.B, E as the question mentions preparation for PTA, this article helped me decide on this outcome. https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-pta-quick-start

I am under the impression that this question should refer to Microsoft Entra Cloud Sync and not Microsoft Entra Connect (previously called "Azure AD Connect"). I also noticed that the "Modify user logon name for each user account" option is incorrect. In fact, we changed the "User Login Name". However, this option tricks us into thinking that the login name needs to be changed, but in reality it is the domain that needs to be changed.

A and E is definitely correct at least. B is not correct because you configure this in Entra ID Prior to enabling Pass-through Authentication through Microsoft Entra Connect with Step 2, download the latest release of the PTA agent from the Microsoft Entra admin center. You need to ensure that your agent is versions 1.5.1742.0. or later. To verify your agent see Upgrade authentication agents After downloading the latest release of the agent, proceed with the below instructions to configure Pass-Through Authentication through Microsoft Entra Connect. https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-pta-quick-start

Prior to enabling Pass-through Authentication through Microsoft Entra Connect with Step 2, download the latest release of the PTA agent from the Microsoft Entra admin center. You need to ensure that your agent is versions 1.5.1742.0. or later. To verify your agent see Upgrade authentication agents A and E is definitely correct at least. B is not correct because you configure this in Entra ID After downloading the latest release of the agent, proceed with the below instructions to configure Pass-Through Authentication through Microsoft Entra Connect.