A would instead validate the other design where a legacy LDAP application moved into Azure still needs domain join and Kerberos without operating domain controllers. That evidence is consistent with use Microsoft Entra Domain Services for supported managed domain functionality, because the managed domain supplies LDAP, Kerberos, and domain join for compatible workloads. It does not demonstrate that the target case achieves an assigned guest can access the published application while an unassigned guest is blocked.

C would instead validate the other design where a B2B procurement portal must permit suppliers to use identities from their home organizations. That evidence is consistent with configure Microsoft Entra B2B collaboration for external guest access, because guests can authenticate using external organizational identities. It does not demonstrate that the target case achieves an assigned guest can access the published application while an unassigned guest is blocked.

D would instead validate the other design where a company keeps on-premises file shares with NTFS ACLs and needs Azure cloud identities linked to AD accounts. That evidence is consistent with maintain supported hybrid identity synchronization and AD DS group-based permissions, because local file authorization remains governed by AD DS and NTFS while identity is synchronized. It does not demonstrate that the target case achieves an assigned guest can access the published application while an unassigned guest is blocked.

“Deploy Microsoft Entra Connect Sync for the supported hybrid directory topology” relies on this Azure capability: directory synchronization maintains on-premises-to-cloud user identity consistency. This workload involves A web application needs centrally controlled access to database connection secrets. The decisive Azure design mechanism is: key Vault centralizes secret operations and the identity avoids application-embedded credentials. Thus “Store application secrets in Azure Key Vault and grant the workload a managed identity” is the applicable architecture choice.

“Manage the supported TLS certificates in Azure Key Vault Certificates” relies on this Azure capability: key Vault can store certificate material and coordinate supported renewal or rotation workflows. This workload involves A web application needs centrally controlled access to database connection secrets. The decisive Azure design mechanism is: key Vault centralizes secret operations and the identity avoids application-embedded credentials. Thus “Store application secrets in Azure Key Vault and grant the workload a managed identity” is the applicable architecture choice.

“Evaluate Azure Key Vault Managed HSM for eligible cryptographic key material” relies on this Azure capability: managed HSM provides tenant-controlled HSM-backed key protection with specialized role separation. This workload involves A web application needs centrally controlled access to database connection secrets. The decisive Azure design mechanism is: key Vault centralizes secret operations and the identity avoids application-embedded credentials. Thus “Store application secrets in Azure Key Vault and grant the workload a managed identity” is the applicable architecture choice.

A would instead validate the other design where a business wants users from Active Directory to appear in the cloud directory using their existing identities. That evidence is consistent with deploy Microsoft Entra Connect Sync for the supported hybrid directory topology, because directory synchronization maintains on-premises-to-cloud user identity consistency. It does not demonstrate that the target case achieves the workload retrieves its approved secret without a password stored in its source code.

B would instead validate the other design where a service hosts TLS endpoints and needs auditable certificate lifecycle management. That evidence is consistent with manage the supported TLS certificates in Azure Key Vault Certificates, because key Vault can store certificate material and coordinate supported renewal or rotation workflows. It does not demonstrate that the target case achieves the workload retrieves its approved secret without a password stored in its source code.

C would instead validate the other design where a financial workload requires dedicated hardware-backed key custody with strong key-administration segregation. That evidence is consistent with evaluate Azure Key Vault Managed HSM for eligible cryptographic key material, because managed HSM provides tenant-controlled HSM-backed key protection with specialized role separation. It does not demonstrate that the target case achieves the workload retrieves its approved secret without a password stored in its source code.

“Manage the supported TLS certificates in Azure Key Vault Certificates” relies on this Azure capability: key Vault can store certificate material and coordinate supported renewal or rotation workflows. This workload involves An enterprise architecture assessment records: A financial workload requires dedicated hardware-backed key custody with strong key-administration segregation. The decisive Azure design mechanism is: managed HSM provides tenant-controlled HSM-backed key protection with specialized role separation. Thus “Evaluate Azure Key Vault Managed HSM for eligible cryptographic key material” is the applicable architecture choice.

“Assign the Key Vault Secrets User data role under the vault's Azure RBAC permission model” relies on this Azure capability: the role grants secret read operations without broad vault administration. This workload involves An enterprise architecture assessment records: A financial workload requires dedicated hardware-backed key custody with strong key-administration segregation. The decisive Azure design mechanism is: managed HSM provides tenant-controlled HSM-backed key protection with specialized role separation. Thus “Evaluate Azure Key Vault Managed HSM for eligible cryptographic key material” is the applicable architecture choice.

“Use versioned Key Vault secret retrieval with a governed rotation strategy” relies on this Azure capability: versioned centralized secrets let workloads discover currently approved values. This workload involves An enterprise architecture assessment records: A financial workload requires dedicated hardware-backed key custody with strong key-administration segregation. The decisive Azure design mechanism is: managed HSM provides tenant-controlled HSM-backed key protection with specialized role separation. Thus “Evaluate Azure Key Vault Managed HSM for eligible cryptographic key material” is the applicable architecture choice.

A would instead validate the other design where a managed identity requires rights to read a Key Vault secret but not modify vault policies. That evidence is consistent with assign the Key Vault Secrets User data role under the vault's Azure RBAC permission model, because the role grants secret read operations without broad vault administration. It does not demonstrate that the target case achieves cryptographic operations complete under HSM policies without exporting protected private key material.

C would instead validate the other design where a service hosts TLS endpoints and needs auditable certificate lifecycle management. That evidence is consistent with manage the supported TLS certificates in Azure Key Vault Certificates, because key Vault can store certificate material and coordinate supported renewal or rotation workflows. It does not demonstrate that the target case achieves cryptographic operations complete under HSM policies without exporting protected private key material.

D would instead validate the other design where a security team wants to rotate encryption secrets without changing application code at every rotation. That evidence is consistent with use versioned Key Vault secret retrieval with a governed rotation strategy, because versioned centralized secrets let workloads discover currently approved values. It does not demonstrate that the target case achieves cryptographic operations complete under HSM policies without exporting protected private key material.

“Use versioned Key Vault secret retrieval with a governed rotation strategy” relies on this Azure capability: versioned centralized secrets let workloads discover currently approved values. This workload involves A cloud migration design must satisfy the following: A service hosts TLS endpoints and needs auditable certificate lifecycle management. The decisive Azure design mechanism is: key Vault can store certificate material and coordinate supported renewal or rotation workflows. Thus “Manage the supported TLS certificates in Azure Key Vault Certificates” is the applicable architecture choice.

“Enable the Azure RBAC permission model for Key Vault with distinct scoped data roles” relies on this Azure capability: distinct control- and data-plane roles enforce least privilege. This workload involves A cloud migration design must satisfy the following: A service hosts TLS endpoints and needs auditable certificate lifecycle management. The decisive Azure design mechanism is: key Vault can store certificate material and coordinate supported renewal or rotation workflows. Thus “Manage the supported TLS certificates in Azure Key Vault Certificates” is the applicable architecture choice.

“Require phishing-resistant multifactor authentication through Microsoft Entra Conditional Access” relies on this Azure capability: conditional policies can enforce stronger authentication methods for high-value access. This workload involves A cloud migration design must satisfy the following: A service hosts TLS endpoints and needs auditable certificate lifecycle management. The decisive Azure design mechanism is: key Vault can store certificate material and coordinate supported renewal or rotation workflows. Thus “Manage the supported TLS certificates in Azure Key Vault Certificates” is the applicable architecture choice.

A would instead validate the other design where a security team wants to rotate encryption secrets without changing application code at every rotation. That evidence is consistent with use versioned Key Vault secret retrieval with a governed rotation strategy, because versioned centralized secrets let workloads discover currently approved values. It does not demonstrate that the target case achieves a new certificate version becomes available under the configured renewal process.

B would instead validate the other design where a company wants stronger employee sign-in for sensitive administrative portals. That evidence is consistent with require phishing-resistant multifactor authentication through Microsoft Entra Conditional Access, because conditional policies can enforce stronger authentication methods for high-value access. It does not demonstrate that the target case achieves a new certificate version becomes available under the configured renewal process.

C would instead validate the other design where an administrator needs separation of duties between vault administrators and secret readers. That evidence is consistent with enable the Azure RBAC permission model for Key Vault with distinct scoped data roles, because distinct control- and data-plane roles enforce least privilege. It does not demonstrate that the target case achieves a new certificate version becomes available under the configured renewal process.

“Store application secrets in Azure Key Vault and grant the workload a managed identity” relies on this Azure capability: key Vault centralizes secret operations and the identity avoids application-embedded credentials. This workload involves A security team wants to rotate encryption secrets without changing application code at every rotation. The decisive Azure design mechanism is: versioned centralized secrets let workloads discover currently approved values. Thus “Use versioned Key Vault secret retrieval with a governed rotation strategy” is the applicable architecture choice.

“Manage contractors as Microsoft Entra external identities with access governance” relies on this Azure capability: guest identity lifecycle controls reduce persistent unmanaged accounts. This workload involves A security team wants to rotate encryption secrets without changing application code at every rotation. The decisive Azure design mechanism is: versioned centralized secrets let workloads discover currently approved values. Thus “Use versioned Key Vault secret retrieval with a governed rotation strategy” is the applicable architecture choice.

“Enable the Azure RBAC permission model for Key Vault with distinct scoped data roles” relies on this Azure capability: distinct control- and data-plane roles enforce least privilege. This workload involves A security team wants to rotate encryption secrets without changing application code at every rotation. The decisive Azure design mechanism is: versioned centralized secrets let workloads discover currently approved values. Thus “Use versioned Key Vault secret retrieval with a governed rotation strategy” is the applicable architecture choice.

A would instead validate the other design where a company wants one cloud identity per contractor with clearly time-limited collaboration access. That evidence is consistent with manage contractors as Microsoft Entra external identities with access governance, because guest identity lifecycle controls reduce persistent unmanaged accounts. It does not demonstrate that the target case achieves the application uses the newest approved secret version after rotation.

C would instead validate the other design where a web application needs centrally controlled access to database connection secrets. That evidence is consistent with store application secrets in Azure Key Vault and grant the workload a managed identity, because key Vault centralizes secret operations and the identity avoids application-embedded credentials. It does not demonstrate that the target case achieves the application uses the newest approved secret version after rotation.

D would instead validate the other design where an administrator needs separation of duties between vault administrators and secret readers. That evidence is consistent with enable the Azure RBAC permission model for Key Vault with distinct scoped data roles, because distinct control- and data-plane roles enforce least privilege. It does not demonstrate that the target case achieves the application uses the newest approved secret version after rotation.

“Evaluate Azure Key Vault Managed HSM for eligible cryptographic key material” relies on this Azure capability: managed HSM provides tenant-controlled HSM-backed key protection with specialized role separation. This workload involves An Azure solution needs to solve the following challenge: An administrator needs separation of duties between vault administrators and secret readers. The decisive Azure design mechanism is: distinct control- and data-plane roles enforce least privilege. Thus “Enable the Azure RBAC permission model for Key Vault with distinct scoped data roles” is the applicable architecture choice.

“Preserve AD DS authentication and connect devices through the approved hybrid network path” relies on this Azure capability: network reachability and domain trust are required for conventional on-premises Kerberos resources. This workload involves An Azure solution needs to solve the following challenge: An administrator needs separation of duties between vault administrators and secret readers. The decisive Azure design mechanism is: distinct control- and data-plane roles enforce least privilege. Thus “Enable the Azure RBAC permission model for Key Vault with distinct scoped data roles” is the applicable architecture choice.

“Store application secrets in Azure Key Vault and grant the workload a managed identity” relies on this Azure capability: key Vault centralizes secret operations and the identity avoids application-embedded credentials. This workload involves An Azure solution needs to solve the following challenge: An administrator needs separation of duties between vault administrators and secret readers. The decisive Azure design mechanism is: distinct control- and data-plane roles enforce least privilege. Thus “Enable the Azure RBAC permission model for Key Vault with distinct scoped data roles” is the applicable architecture choice.

A would instead validate the other design where a financial workload requires dedicated hardware-backed key custody with strong key-administration segregation. That evidence is consistent with evaluate Azure Key Vault Managed HSM for eligible cryptographic key material, because managed HSM provides tenant-controlled HSM-backed key protection with specialized role separation. It does not demonstrate that the target case achieves a vault administrator without a data role cannot read secret values.

B would instead validate the other design where a web application needs centrally controlled access to database connection secrets. That evidence is consistent with store application secrets in Azure Key Vault and grant the workload a managed identity, because key Vault centralizes secret operations and the identity avoids application-embedded credentials. It does not demonstrate that the target case achieves a vault administrator without a data role cannot read secret values.

C would instead validate the other design where a business wants staff on managed Windows devices to authenticate to an on-premises application using established domain access. That evidence is consistent with preserve AD DS authentication and connect devices through the approved hybrid network path, because network reachability and domain trust are required for conventional on-premises Kerberos resources. It does not demonstrate that the target case achieves a vault administrator without a data role cannot read secret values.