Practice question 89 of 180 · medium
A company must keep its existing AD DS Group Policy and Kerberos-dependent applications, while enabling modern Entra token-based SSO to Windows. Its users are synchronized to the AVD tenant. Which session-host identity design best meets these requirements?
Choose the single best answer.
Show the answer and explanation
✓ Correct answer
- Join the hosts to AD DS and configure Microsoft Entra hybrid join.
Hybrid join preserves AD DS domain management and Kerberos dependencies while satisfying the host-join requirement for modern Entra SSO. Complete the documented SSO and Kerberos prerequisites. Option explanations: A. Use standalone AD DS hosts and authenticate the AVD service with AD FS alone.: AD DS-only hosts do not qualify for modern Entra SSO, and the AVD cloud service still requires Entra identity. B. Join the hosts only to Microsoft Entra Domain Services.: Managed-domain-only join does not support the modern Entra token-based SSO path required here. C. Use local Windows accounts for the hosts and Entra accounts for the AVD feed.: AVD does not support different identities for cloud-service authentication and Windows session sign-in. D. Join the hosts to AD DS and configure Microsoft Entra hybrid join.: Hybrid-joined hosts retain AD DS and also meet the supported modern Entra SSO join condition. Sources: Supported identities and authentication methods — https://learn.microsoft.com/en-us/azure/virtual-desktop/authentication; Configure single sign-on for Azure Virtual Desktop using Microsoft Entra ID — https://learn.microsoft.com/en-us/azure/virtual-desktop/configure-single-sign-on
Read and review here, or open the app to practise and save your results on this device.
Unofficial study aid, not affiliated with or endorsed by Microsoft. Original educational practice questions, not official exam questions or a prediction of an exam result. Use Microsoft Learn and hands-on labs alongside this course.