Practice question 90 of 180 · medium
An organization invites external Entra users into its resource tenant. The users need cloud applications only. New hosts use the documented supported OS and updates, but the proposed pool is AD DS-only and uses legacy host authentication. Which architectural changes are required for the external-user design?
Select all that apply. Every correct option and no extras are required for credit in the app.
Show the answer and explanation
✓ Correct answers
- Enable Microsoft Entra SSO on the host pool.
- Use Microsoft Entra-joined session hosts.
Invited external identities require Entra-joined hosts and host-pool Entra SSO. The scenario already provides the OS/update and tenant-invitation prerequisites and avoids unsupported legacy-resource access. Option explanations: A. Enable Microsoft Entra SSO on the host pool.: Host-pool Entra SSO provides the required Windows authentication path for these external identities. B. Enable NTLM host authentication for the external users.: External identities cannot use Kerberos or NTLM for on-premises resource access, and NTLM does not supply the required SSO path. C. Use Microsoft Entra-joined session hosts.: Entra join is the required session-host identity scenario for invited external users. D. Create matching local administrator accounts for the external users.: Local administrator accounts neither meet the supported identity design nor supply application entitlement. Sources: Supported identities and authentication methods — https://learn.microsoft.com/en-us/azure/virtual-desktop/authentication
Read and review here, or open the app to practise and save your results on this device.
Unofficial study aid, not affiliated with or endorsed by Microsoft. Original educational practice questions, not official exam questions or a prediction of an exam result. Use Microsoft Learn and hands-on labs alongside this course.