Exam SC-300 topic 2 question 111 discussion

Anbocer is correct. Answer D

The correct answer is: D. Pass-through authentication Explanation: To ensure that on-premises account lockout policies are applied to Microsoft Entra (Azure AD) sign-ins, you must use pass-through authentication (PTA). Here's why: Pass-through authentication allows Microsoft Entra to authenticate users directly against the on-premises Active Directory. This means that any policies enforced in AD, including account lockout policies, are applied during sign-in. In contrast: Password hash synchronization (PHS) hashes passwords and syncs them to Microsoft Entra, meaning authentication happens in the cloud, not against the on-premises AD. On-premises account lockout policies do not apply in this scenario. Azure AD Seamless Single Sign-On (SSO) simplifies sign-in for users but does not enforce on-premises account lockout policies by itself. Microsoft Entra Cloud Sync is used for syncing users and groups but does not affect authentication methods or enforce on-premises policies.