Question

Contoso currently uses Microsoft Entra Connect Sync with federation to AD FS for all sign-ins. The security team wants to decommission the AD FS farm to reduce on-premises infrastructure while keeping the same on-premises passwords usable in the cloud and ensuring sign-in continues to work if the on-premises servers or network go offline. Which authentication method should you configure before converting the domains from federated to managed?

Accepted Answer

Enable password hash synchronization (PHS) and convert the domains to managed authentication

Answer

Deploy pass-through authentication (PTA) agents and convert the domains to managed authentication

Answer

Keep federation but replace AD FS with a third-party SAML identity provider

Answer

Enable seamless SSO only and convert the domains to managed authentication