Exam AZ-303 topic 2 question 16 discussion

Actual exam question from Microsoft's AZ-303

Question #: 16
Topic #: 2

HOTSPOT -
Your network contains an on-premises Active Directory domain named contoso.com that contains a user named User1. The domain syncs to Azure Active
Directory (Azure AD).
You have the Windows 10 devices shown in the following table.

The User Sign-In settings are configured as shown in the following exhibit.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

Show Suggested Answer

Suggested Answer:

Box 1: Yes -
Seamless SSO needs the user's device to be domain-joined only, but it is not used on Azure AD Joined or Hybrid Azure AD joined devices. SSO on Azure AD joined, Hybrid Azure AD joined, and Azure AD registered devices works based on the primary refresh token.

Box 2: No -

Box 3: No -
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso

by OmerBeyond at Jan. 4, 2021, 7:30 a.m.

Comments

Submit Cancel

azurecert2021

Highly Voted 4 years, 5 months ago

answer should be Y Y N key benefit of Seamless SSO is Users are automatically signed into both on-premises and cloud-based applications and can be combined with either the Password Hash Synchronization or Pass-through Authentication sign-in methods. However this feature cannot be used with Active Directory Federation Services (ADFS). Azure AD Join provides SSO to users if their devices are registered with Azure AD. These devices don't necessarily have to be domain-joined. SSO is provided using primary refresh tokens or PRTs, and not Kerberos.

upvoted 82 times

...

Koba

Highly Voted 4 years, 5 months ago

Y N N Seamless SSO needs the user's device to be domain-joined only, but it is not used on Azure AD Joined or Hybrid Azure AD joined devices. SSO on Azure AD joined, Hybrid Azure AD joined, and Azure AD registered devices works based on the primary refresh token. https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso

upvoted 19 times

dandirindan

4 years, 5 months ago

this explanation is great and from microsoft perspective, https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso#key-benefits

upvoted 4 times

HDZ78

4 years ago

Actually that article clearly shows the answer should be Y Y N, "For Windows 10, Windows Server 2016 and later versions, it’s recommended to use SSO via primary refresh token (PRT). For windows 7 and 8.1 it’s recommended to use Seamless SSO. Seamless SSO needs the user's device to be domain-joined, but it is not used on Windows 10 Azure AD joined devices or hybrid Azure AD joined devices. SSO on Azure AD joined, Hybrid Azure AD joined, and Azure AD registered devices works based on the Primary Refresh Token (PRT)". The question clearly states at the start that these are Windows 10 devices.

upvoted 14 times

gizda2

3 years, 9 months ago

Listen to this guy folks. ^^ This is the most useful comment in this thread.

upvoted 4 times

...

3 years, 10 months ago

1. Device1 is AD joined, so user will sign in automatically by using SSO. 2. Seamless SSO needs the user's device to be domain-joined only, but it is not used on Azure AD Joined or Hybrid Azure AD joined devices. So, from Device2 and Device3, SSO will not work. https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso Yes No No is the answer

upvoted 2 times