Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Microsoft 365 Certified: Endpoint Administrator Associate · Microsoft
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
A: Pass-through authentication requires the installation of an authentication agent. C: The on-premises AD domain name ".local" cannot be used online. Therefore, an alternative UPN suffix must be added. F: The user's UPN will be changed to an alternative UPN suffix (.onmicrosoft.com), which will change the logon name. Many people agree that answer E is correct, but since the standard tenant name is (.onmicrosoft.com), adding a custom domain should not be necessary.
Basically a Pass-through Authentication Agent is installed on the same server as Microsoft Entra Connect. So there is no need to install it on a domain controller and also not a good security approach to install any agents apart from few exceptions like "Identity Protection" etc. For high availability we can install another authentication agent on any member server like server 2016 with TLS 1.2 enabled. Here is more info : https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-pta-quick-start
C / E / F Why the other options are not needed: A. Install an Authentication Agent on a domain controller – The first PTA agent is installed automatically on the Azure AD Connect server you’re already planning to deploy; extra agents on DCs are optional, not a prep requirement. B. Configure an authentication method in the Entra admin center – Refers to MFA/passwordless methods, which are independent of enabling PTA. D. Modify the email address attribute for each user account – The mail/SMTP address doesn’t affect PTA; authentication relies on the UPN, not the email attribute.