Medium1 markMultiple Choice
Domain 1.2: Authentication and AuthorizationDomain 1IdentityEntra DSMigration

AZ-305 · Question 09 · Domain 1.2: Authentication and Authorization

Your company is migrating several legacy applications to Azure Virtual Machines.

These applications rely on LDAP read/write operations, NTLM authentication, and require servers to be joined to an Active Directory domain. The company has already synchronized their on-premises Active Directory to Microsoft Entra ID using Entra Connect.

The CIO wants to decommission the on-premises domain controllers and avoid deploying new IaaS domain controllers in Azure to minimize management overhead (patching, backups).

Which TWO actions should you take to support the legacy applications? (Select TWO)

Answer options:

A.

Deploy Microsoft Entra Domain Services (Entra DS).

B.

Configure Microsoft Entra Application Proxy.

C.

Join the Azure VMs to the Entra DS managed domain.

D.

Join the Azure VMs directly to Microsoft Entra ID.

E.

Deploy a Site-to-Site VPN to on-premises.

How to approach this question

Recognize that legacy protocols (LDAP, NTLM) require traditional AD DS. If IaaS VMs are forbidden, the PaaS alternative is Entra Domain Services.

Full Answer

Microsoft Entra ID is a modern identity provider and does not support legacy protocols like LDAP, NTLM, or Kerberos. To support legacy applications without managing IaaS domain controllers, you must deploy Microsoft Entra Domain Services (Entra DS). Entra DS provides a managed domain (PaaS) that synchronizes users from Entra ID. You must then join the Azure VMs hosting the applications to this managed domain so they can authenticate using NTLM and query via LDAP.

Common mistakes

Confusing Entra ID Join with Entra DS Join. Entra ID Join does not support LDAP/NTLM.

Practice the full Azure Solutions Architect Expert AZ-305 Practice Exam 5

55 questions · hints · full answers · grading

More questions from this exam