Exam MS-100 topic 3 question 69 discussion

I think cloud password expiration for a synced account would be ignored unless you enable a specific feature. So I would be inclined to go for YNN https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-password-hash-synchronization#enforcecloudpasswordpolicyforpasswordsyncedusers When EnforceCloudPasswordPolicyForPasswordSyncedUsers is disabled (which is the default setting), Azure AD Connect sets the PasswordPolicies attribute of synchronized users to "DisablePasswordExpiration". This is done every time a user's password is synchronized and instructs Azure AD to ignore the cloud password expiration policy for that user.

Guessing that the policy is fairly default. An on prem policy would win over a policy in AzureAD and password writeback is disabled, that already tells you a lot about the possible answers.

From another source on this very question: Box 3: Yes - The password for the Azure AD User1 account will expire after 90 days according to the Azure AD password policy. If the on-premise password policy has a shorter password expiration period, User1 would have the change his/her on-premise AD password. The new password would then sync to Azure AD. Reference: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-install-express I looked at the provided article, but see no mention of password policy in the article. Again, I think there's a missing image. Default is set to 90 days in AzureAD, the policy doesn't apply to accounts synchronized from AD DS unless the enforced cloud password policy is applied. Really hate this question.

Looking at the first link further: The Azure AD password policy doesn't apply to user accounts synchronized from an on-premises AD DS environment using Azure AD Connect, unless you enable EnforceCloudPasswordPolicyForPasswordSyncedUsers. So, let's look at it this way: 1. Yes. The user is created on-prem and it will sync to Azure AD 2. No. Password write-back is disabled. 3. Probably No. There is no second exhibit, password write-back is disabled and most importantly, if the user is created on-prem and sync'd to AzureAD, then the password defaults in Azure should not be applicable to the sync'd users. Doesn't matter if the default policy is 90 days if the directory is sync'd to Azure, and again, how would that even work if writeback is disabled? This, of course, is assuming EnforceCloudPasswordPolicyForPasswordSyncedUsers wasn't enabled. Since we don't have an image for exhibit 2, who knows?

Also YNN if you consider writeback is disabled.