A would instead validate the other design where a company wants stronger employee sign-in for sensitive administrative portals. That evidence is consistent with require phishing-resistant multifactor authentication through Microsoft Entra Conditional Access, because conditional policies can enforce stronger authentication methods for high-value access. It does not demonstrate that the target case achieves the service obtains a scoped access token without storing a client secret.

B would instead validate the other design where a workforce application should authenticate employees with their existing cloud directory accounts without local passwords. That evidence is consistent with integrate the application with Microsoft Entra ID using OpenID Connect, because oIDC delegates user sign-in to a trusted identity provider. It does not demonstrate that the target case achieves the service obtains a scoped access token without storing a client secret.

C would instead validate the other design where a service hosts TLS endpoints and needs auditable certificate lifecycle management. That evidence is consistent with manage the supported TLS certificates in Azure Key Vault Certificates, because key Vault can store certificate material and coordinate supported renewal or rotation workflows. It does not demonstrate that the target case achieves the service obtains a scoped access token without storing a client secret.

“Configure Microsoft Entra automatic application provisioning with SCIM where supported” relies on this Azure capability: lifecycle provisioning propagates identity creations, updates, and deprovisioning. This workload involves A business wants users from Active Directory to appear in the cloud directory using their existing identities. The decisive Azure design mechanism is: directory synchronization maintains on-premises-to-cloud user identity consistency. Thus “Deploy Microsoft Entra Connect Sync for the supported hybrid directory topology” is the applicable architecture choice.

“Evaluate Microsoft Entra Cloud Sync for supported directory objects and topology” relies on this Azure capability: cloud Sync uses lightweight agents and cloud-controlled provisioning. This workload involves A business wants users from Active Directory to appear in the cloud directory using their existing identities. The decisive Azure design mechanism is: directory synchronization maintains on-premises-to-cloud user identity consistency. Thus “Deploy Microsoft Entra Connect Sync for the supported hybrid directory topology” is the applicable architecture choice.

“Integrate the application with Microsoft Entra ID using OpenID Connect” relies on this Azure capability: oIDC delegates user sign-in to a trusted identity provider. This workload involves A business wants users from Active Directory to appear in the cloud directory using their existing identities. The decisive Azure design mechanism is: directory synchronization maintains on-premises-to-cloud user identity consistency. Thus “Deploy Microsoft Entra Connect Sync for the supported hybrid directory topology” is the applicable architecture choice.

A would instead validate the other design where a SaaS application should receive user accounts and removal events automatically from the enterprise directory. That evidence is consistent with configure Microsoft Entra automatic application provisioning with SCIM where supported, because lifecycle provisioning propagates identity creations, updates, and deprovisioning. It does not demonstrate that the target case achieves an on-premises account change is reflected in the matching cloud identity after synchronization.

C would instead validate the other design where a workforce application should authenticate employees with their existing cloud directory accounts without local passwords. That evidence is consistent with integrate the application with Microsoft Entra ID using OpenID Connect, because oIDC delegates user sign-in to a trusted identity provider. It does not demonstrate that the target case achieves an on-premises account change is reflected in the matching cloud identity after synchronization.

D would instead validate the other design where a company operates many branch forests and wants a cloud-managed hybrid identity synchronization agent. That evidence is consistent with evaluate Microsoft Entra Cloud Sync for supported directory objects and topology, because cloud Sync uses lightweight agents and cloud-controlled provisioning. It does not demonstrate that the target case achieves an on-premises account change is reflected in the matching cloud identity after synchronization.

“Configure Microsoft Entra automatic application provisioning with SCIM where supported” relies on this Azure capability: lifecycle provisioning propagates identity creations, updates, and deprovisioning. This workload involves A company operates many branch forests and wants a cloud-managed hybrid identity synchronization agent. The decisive Azure design mechanism is: cloud Sync uses lightweight agents and cloud-controlled provisioning. Thus “Evaluate Microsoft Entra Cloud Sync for supported directory objects and topology” is the applicable architecture choice.

“Assign the Key Vault Secrets User data role under the vault's Azure RBAC permission model” relies on this Azure capability: the role grants secret read operations without broad vault administration. This workload involves A company operates many branch forests and wants a cloud-managed hybrid identity synchronization agent. The decisive Azure design mechanism is: cloud Sync uses lightweight agents and cloud-controlled provisioning. Thus “Evaluate Microsoft Entra Cloud Sync for supported directory objects and topology” is the applicable architecture choice.

“Use a workload identity or service principal with Azure role assignments” relies on this Azure capability: separate workload identities support auditable and least-privilege automation. This workload involves A company operates many branch forests and wants a cloud-managed hybrid identity synchronization agent. The decisive Azure design mechanism is: cloud Sync uses lightweight agents and cloud-controlled provisioning. Thus “Evaluate Microsoft Entra Cloud Sync for supported directory objects and topology” is the applicable architecture choice.

A would instead validate the other design where a SaaS application should receive user accounts and removal events automatically from the enterprise directory. That evidence is consistent with configure Microsoft Entra automatic application provisioning with SCIM where supported, because lifecycle provisioning propagates identity creations, updates, and deprovisioning. It does not demonstrate that the target case achieves selected directory users are provisioned into Entra ID without a traditional full sync server.

B would instead validate the other design where a managed identity requires rights to read a Key Vault secret but not modify vault policies. That evidence is consistent with assign the Key Vault Secrets User data role under the vault's Azure RBAC permission model, because the role grants secret read operations without broad vault administration. It does not demonstrate that the target case achieves selected directory users are provisioned into Entra ID without a traditional full sync server.

C would instead validate the other design where a platform team needs nonhuman principals for automated Azure deployments with scoped permissions. That evidence is consistent with use a workload identity or service principal with Azure role assignments, because separate workload identities support auditable and least-privilege automation. It does not demonstrate that the target case achieves selected directory users are provisioned into Entra ID without a traditional full sync server.

“Manage contractors as Microsoft Entra external identities with access governance” relies on this Azure capability: guest identity lifecycle controls reduce persistent unmanaged accounts. This workload involves A proposed Azure workload has the following constraint: A SaaS application should receive user accounts and removal events automatically from the enterprise directory. The decisive Azure design mechanism is: lifecycle provisioning propagates identity creations, updates, and deprovisioning. Thus “Configure Microsoft Entra automatic application provisioning with SCIM where supported” is the applicable architecture choice.

“Evaluate Azure Key Vault Managed HSM for eligible cryptographic key material” relies on this Azure capability: managed HSM provides tenant-controlled HSM-backed key protection with specialized role separation. This workload involves A proposed Azure workload has the following constraint: A SaaS application should receive user accounts and removal events automatically from the enterprise directory. The decisive Azure design mechanism is: lifecycle provisioning propagates identity creations, updates, and deprovisioning. Thus “Configure Microsoft Entra automatic application provisioning with SCIM where supported” is the applicable architecture choice.

“Use a workload identity or service principal with Azure role assignments” relies on this Azure capability: separate workload identities support auditable and least-privilege automation. This workload involves A proposed Azure workload has the following constraint: A SaaS application should receive user accounts and removal events automatically from the enterprise directory. The decisive Azure design mechanism is: lifecycle provisioning propagates identity creations, updates, and deprovisioning. Thus “Configure Microsoft Entra automatic application provisioning with SCIM where supported” is the applicable architecture choice.

A would instead validate the other design where a company wants one cloud identity per contractor with clearly time-limited collaboration access. That evidence is consistent with manage contractors as Microsoft Entra external identities with access governance, because guest identity lifecycle controls reduce persistent unmanaged accounts. It does not demonstrate that the target case achieves the SaaS account is created and later disabled following source-directory changes.

C would instead validate the other design where a platform team needs nonhuman principals for automated Azure deployments with scoped permissions. That evidence is consistent with use a workload identity or service principal with Azure role assignments, because separate workload identities support auditable and least-privilege automation. It does not demonstrate that the target case achieves the SaaS account is created and later disabled following source-directory changes.

D would instead validate the other design where a financial workload requires dedicated hardware-backed key custody with strong key-administration segregation. That evidence is consistent with evaluate Azure Key Vault Managed HSM for eligible cryptographic key material, because managed HSM provides tenant-controlled HSM-backed key protection with specialized role separation. It does not demonstrate that the target case achieves the SaaS account is created and later disabled following source-directory changes.

“Deploy Microsoft Entra Connect Sync for the supported hybrid directory topology” relies on this Azure capability: directory synchronization maintains on-premises-to-cloud user identity consistency. This workload involves During a cloud design workshop, stakeholders explain: A platform team needs nonhuman principals for automated Azure deployments with scoped permissions. The decisive Azure design mechanism is: separate workload identities support auditable and least-privilege automation. Thus “Use a workload identity or service principal with Azure role assignments” is the applicable architecture choice.

“Enable a managed identity and request a Microsoft Entra access token” relies on this Azure capability: workload-managed identity replaces credentials embedded in application configuration. This workload involves During a cloud design workshop, stakeholders explain: A platform team needs nonhuman principals for automated Azure deployments with scoped permissions. The decisive Azure design mechanism is: separate workload identities support auditable and least-privilege automation. Thus “Use a workload identity or service principal with Azure role assignments” is the applicable architecture choice.

“Manage contractors as Microsoft Entra external identities with access governance” relies on this Azure capability: guest identity lifecycle controls reduce persistent unmanaged accounts. This workload involves During a cloud design workshop, stakeholders explain: A platform team needs nonhuman principals for automated Azure deployments with scoped permissions. The decisive Azure design mechanism is: separate workload identities support auditable and least-privilege automation. Thus “Use a workload identity or service principal with Azure role assignments” is the applicable architecture choice.

A would instead validate the other design where a business wants users from Active Directory to appear in the cloud directory using their existing identities. That evidence is consistent with deploy Microsoft Entra Connect Sync for the supported hybrid directory topology, because directory synchronization maintains on-premises-to-cloud user identity consistency. It does not demonstrate that the target case achieves the deployment has only its assigned permissions and produces principal-specific audit events.

B would instead validate the other design where an Azure-hosted service needs to authenticate to an Azure API without deploying any long-lived client secret. That evidence is consistent with enable a managed identity and request a Microsoft Entra access token, because workload-managed identity replaces credentials embedded in application configuration. It does not demonstrate that the target case achieves the deployment has only its assigned permissions and produces principal-specific audit events.

C would instead validate the other design where a company wants one cloud identity per contractor with clearly time-limited collaboration access. That evidence is consistent with manage contractors as Microsoft Entra external identities with access governance, because guest identity lifecycle controls reduce persistent unmanaged accounts. It does not demonstrate that the target case achieves the deployment has only its assigned permissions and produces principal-specific audit events.

“Deploy Microsoft Entra Connect Sync for the supported hybrid directory topology” relies on this Azure capability: directory synchronization maintains on-premises-to-cloud user identity consistency. This workload involves A company wants one cloud identity per contractor with clearly time-limited collaboration access. The decisive Azure design mechanism is: guest identity lifecycle controls reduce persistent unmanaged accounts. Thus “Manage contractors as Microsoft Entra external identities with access governance” is the applicable architecture choice.

“Evaluate Microsoft Entra Cloud Sync for supported directory objects and topology” relies on this Azure capability: cloud Sync uses lightweight agents and cloud-controlled provisioning. This workload involves A company wants one cloud identity per contractor with clearly time-limited collaboration access. The decisive Azure design mechanism is: guest identity lifecycle controls reduce persistent unmanaged accounts. Thus “Manage contractors as Microsoft Entra external identities with access governance” is the applicable architecture choice.

“Preserve AD DS authentication and connect devices through the approved hybrid network path” relies on this Azure capability: network reachability and domain trust are required for conventional on-premises Kerberos resources. This workload involves A company wants one cloud identity per contractor with clearly time-limited collaboration access. The decisive Azure design mechanism is: guest identity lifecycle controls reduce persistent unmanaged accounts. Thus “Manage contractors as Microsoft Entra external identities with access governance” is the applicable architecture choice.

A would instead validate the other design where a business wants users from Active Directory to appear in the cloud directory using their existing identities. That evidence is consistent with deploy Microsoft Entra Connect Sync for the supported hybrid directory topology, because directory synchronization maintains on-premises-to-cloud user identity consistency. It does not demonstrate that the target case achieves contractor access expires or is removed according to the agreed governance lifecycle.

C would instead validate the other design where a company operates many branch forests and wants a cloud-managed hybrid identity synchronization agent. That evidence is consistent with evaluate Microsoft Entra Cloud Sync for supported directory objects and topology, because cloud Sync uses lightweight agents and cloud-controlled provisioning. It does not demonstrate that the target case achieves contractor access expires or is removed according to the agreed governance lifecycle.

D would instead validate the other design where a business wants staff on managed Windows devices to authenticate to an on-premises application using established domain access. That evidence is consistent with preserve AD DS authentication and connect devices through the approved hybrid network path, because network reachability and domain trust are required for conventional on-premises Kerberos resources. It does not demonstrate that the target case achieves contractor access expires or is removed according to the agreed governance lifecycle.