Quick Note — Recommend an Authentication Solution
AZ-305 › Unit 1 › Design authentication and authorization solutions › Recommend an authentication solution
Quick Note — Recommend an Authentication Solution
This lesson aligns with AZ-305 Chapter 2, §2.1–2.2, p. 41–65 and covers the architecture and design considerations for authenticating users and applications in Azure. We focus on Microsoft Entra ID (formerly Azure AD) as the identity platform, multi-factor authentication (MFA), Conditional Access policies, passwordless authentication methods, and authentication protocols such as SAML 2.0, OAuth 2.0, and OpenID Connect (OIDC). This is not a lesson on identity governance or lifecycle management (see LO-5), nor on authorization and RBAC (see LO-6/LO-7) — it is about how to verify who someone is when they attempt to access resources.
Retrieval target
- Recommend an Authentication Solution
- Closed-book recall
- 5 minutes
- Open the full lesson after a miss
Decision anchors
| Prompt | Compact answer |
|---|---|
Microsoft Entra ID | Microsoft's cloud identity-and-access platform (formerly Azure Active Directory). Issues identities, authenticates users, and authorizes access to cloud apps and Azure resources. The tenant is the directory boundary — one Microsoft 365 / Azure subscription is associated with exactly one Entra tenant. |
Multi-factor authentication (MFA) | An authentication method that requires more than one challenge before granting access: something you have (phone, key, FIDO2), know (password, PIN), are (biometrics), or where you are (location). The most effective single control for reducing credential-theft risk in Entra ID. |
Conditional Access policy | An if/then rule in Entra ID — if signals match (user, app, device platform, location, client app, risk level), then grant or block, optionally requiring extra controls like MFA or a compliant device. The standard tool for enforcing MFA, blocking legacy auth, and acting on Identity Protection risk signals. |
Password hash synchronization (PHS) | An Entra Connect sign-in method that synchronizes a hash of the on-prem AD password hash into Entra ID. Users authenticate in the cloud — no on-prem dependency at sign-in. Simplest hybrid option; tolerates on-prem outages because Entra can validate the password by itself. |
Read the answers once, then cover the right-hand column and reconstruct each one from the prompt. A useful answer names the requirement, the recommended control or service boundary, and the nearest alternative it rejects. If you can only recognize the answer after seeing it, retrieval is not yet secure.
Ninety-second explanation
Without notes, explain:
- What requirement signals this learning objective rather than a neighbouring one?
- Which two solution families are most likely to be compared?
- Which hard constraint eliminates the strongest distractor?
- What identity, network, data, or failure boundary must appear in the design?
- Which operational test would prove the recommendation works?
Then compare your explanation with the full lesson. Record the missing decision rule—not merely the missed product name—in your error log.
When to open the full lesson
Open the curriculum-linked lesson when you cannot explain a comparison, when a scenario depends on a numeric limit or SKU feature, or when the service is on a retirement path. Use current Microsoft Learn documentation for availability, limits, pricing, naming, and migration milestones; the quick note is intentionally compact.
Source and freshness
Derived from the linked AZ-305 lesson and retrieval deck, grounded in both attached course sources. Reviewed 2026-08-02. Current Microsoft documentation controls changing product contracts.