AZ-305
Deep Dive
AZ-305 doesn't ask "what is Entra ID" — it asks when and how to design the identity solution: how many tenants, which hybrid authentication method, when to use B2B vs External ID, and what type of identity to assign to each workload. Here we master those decision criteria.
Contents
🏛️Azure governance hierarchy — Policy and RBAC inheritance
Policies and RBAC assigned at higher levels are inherited downward. Hover over a node to see its full inheritance chain.
⬇️ Downward inheritance
RBAC and Policies on Root MG apply to ALL levels. A child cannot override what a parent enforces with a Deny effect.
🔒 Assignment scope
Assigning at the highest possible level reduces management overhead. 1 policy on Root MG = coverage for the whole tenant.
🏷️ Tags do NOT auto-inherit
Unlike RBAC/Policy, tags on an RG do NOT propagate to child resources. You need an Azure Policy with a modify effect.
A Microsoft Entra ID tenant is the organization's identity and administration boundary. The default design rule is a single tenant per organization — multiple tenants multiply the complexity of licensing, Conditional Access, B2B and administration.
For the exam: a tenant can have multiple subscriptions, but each subscription trusts exactly one tenant. Moving a subscription between tenants breaks RBAC, managed identities and Key Vault access policies.
When to use a single tenant (default)
When to use multiple tenants (exception)
🔐Árbol de decisión — Método de autenticación híbrida
PHS · PTA · ADFS + herramienta de sincronización
Pregunta 1
¿Existe un requisito de seguridad o compliance que prohíba almacenar hashes de contraseña en la nube de Microsoft?
💡 PHS almacena un hash del hash en Entra ID. Si la política lo permite (mayoría de casos) → PHS. Si dicen "la contraseña no puede salir del datacenter ni en forma de hash" → continúa.
When on-premises Active Directory exists, Entra Connect (or Cloud Sync) synchronizes identities to the cloud. The key AZ-305 decision is where the password is validated. Three options:
| Method | Where it's validated | Extra infrastructure | When to choose it |
|---|---|---|---|
| Password Hash Sync (PHS) | In the cloud — Entra ID validates the synced hash | None (just Entra Connect) | Recommended default. Simplest, works even if on-prem is down, enables leaked credential detection. |
| Pass-through Auth (PTA) | On-premises — PTA agents validate against DCs in real time | 2-3 PTA agents on on-prem servers | Security policy prohibits storing hashes in the cloud, but you want to avoid ADFS complexity. Login fails if on-prem goes down (mitigate with PHS as a fallback). |
| Federation (ADFS) | On-premises — an ADFS farm issues tokens | ADFS farm + WAP + certificates (high complexity) | Only if you need: on-prem smartcards/third-party MFA, or a requirement that authentication never touches the cloud. Microsoft discourages it for new deployments. |
Entra Connect Sync vs Cloud Sync
Entra Domain Services (when)
For legacy applications that require Kerberos/NTLM/LDAP and are migrated to Azure without being rewritten. Entra DS provides a managed domain (no DCs to manage) synced from Entra ID.
Entra ID B2B (collaboration)
Microsoft Entra External ID (customers)
Golden rule for the exam
Partners/employees from another company collaborating with you → B2B (same tenant, guest users). Customers/consumers of your product → External ID (formerly B2C) (separate tenant, social login). If the scenario mentions "social identity providers" or "millions of customers", the answer is External ID (Azure AD B2C only for legacy solutions).
| Type | Who manages credentials | When to use it |
|---|---|---|
| Managed Identity (system-assigned) | Azure — no secrets, lifecycle tied to the resource | Default for Azure resources accessing other Azure services (VM → Key Vault, App Service → SQL). Deleted along with the resource. |
| Managed Identity (user-assigned) | Azure — no secrets, independent lifecycle | Multiple resources share the same identity (a VM fleet, App Service slots), or you pre-provision permissions before creating resources. |
| Service Principal | You — a secret or certificate you rotate manually | Apps outside Azure (external CI/CD, on-premises) or multi-tenant. Last resort if Managed Identity isn't viable. |
| Workload Identity Federation | No one — OIDC federation with no secrets | GitHub Actions, external Kubernetes or another IdP that assumes a service principal with NO stored secrets. Preferred over a service principal with a secret. |
Design principle
Preference hierarchy: Managed Identity > Workload Identity Federation > Service Principal with certificate > Service Principal with secret. If the scenario says "eliminate stored secrets" or "no credential management", the answer is almost always Managed Identity.
| The scenario says... | Design with... |
|---|---|
| Minimal on-prem infrastructure, resilient login even if the datacenter goes down | Password Hash Sync |
| Passwords (or even their hashes) cannot leave on-premises | Pass-through Authentication (+ PHS as a DR fallback if allowed) |
| MFA with on-premises smartcards / full control over the token flow | Federation with ADFS |
| Legacy app with Kerberos/LDAP migrated to Azure, without managing DCs | Entra Domain Services |
| External partners access internal apps with their own credentials | Entra B2B (guests + access reviews) |
| Consumer app with social login at millions-of-users scale | Microsoft Entra External ID (formerly Azure AD B2C) |
| App Service needs to read Key Vault secrets without credentials | Managed Identity (system-assigned) |
| A GitHub Actions pipeline deploys to Azure without stored secrets | Workload Identity Federation |
| Sync several disconnected AD forests with lightweight agents | Entra Cloud Sync |
Did you get this topic?
Test what you just learned
A company with on-premises AD migrates to Azure. Requirements: (1) users must be able to sign in to cloud apps even if the on-premises datacenter is down, (2) minimal additional infrastructure, (3) leaked credential detection. Which hybrid authentication method do you recommend?
Put what you learned to the test with original AZ-305 exam questions.
Start AZ-305 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.