A company uses PHS and disables an employee in on-premises AD during a synchronization outage. Which security expectation should the architect document?

Choose the single best answer.

A.PHS checks current on-premises disabled state for each cloud sign-in even during the outage.
B.Account-state changes may wait for synchronization; address the cloud identity in the response.
C.Disabling an on-premises user immediately removes the user's cloud identity without synchronization.
D.Because PHS is enabled, an on-premises disable automatically revokes every existing cloud session.

Show the answer and explanation

✓ Correct answer

Account-state changes may wait for synchronization; address the cloud identity in the response.

PHS validates in the cloud, and relevant account-state changes depend on synchronization. It does not query current AD state for each sign-in or immediately remove the cloud identity without synchronization. Incident response must also consider cloud accounts and sessions rather than assume that all tokens are instantly revoked. Source: AZ-305 Study Guide.pdf, PDF page(s) 14.

Read the source reference

This item is flagged for content review.

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study aid; not affiliated with or endorsed by Microsoft. Original practice questions are not real examination questions and do not guarantee an exam result.