An organisation currently authenticates its hybrid users through Active Directory Federation Services and wants to move towards a Zero Trust target state where Microsoft Entra ID is the authentication authority, the on-premises federation servers are retired, and risk-based Conditional Access can evaluate every sign-in. Which authentication design best advances this requirement while keeping the existing on-premises directory in place?
- AKeep Active Directory Federation Services as the authority but place a web application proxy in front of it and add claims rules that call Conditional Access during each federated sign-in.
- BDeploy a third-party identity provider to broker authentication between users and Microsoft Entra ID so that sign-in decisions are centralised in that broker instead.
- CRetain federation for existing users and enable cloud authentication only for newly created accounts so that both authentication paths run side by side indefinitely.
- DMove sign-in to Microsoft Entra ID using cloud authentication with password hash synchronisation or pass-through authentication, then decommission the federation servers once cut over. Correct
Why A is wrong: Adding a proxy and claims rules modernises the federation surface and seems pragmatic, but it keeps the on-premises servers as the authority and outside the cloud sign-in pipeline where the full risk signal lives, so it does not reach the intended Zero Trust state.
Why B is wrong: A third-party broker can centralise sign-in and is tempting if one is already licensed, but it moves the authority away from Microsoft Entra ID rather than to it and limits the native risk evaluation, so it contradicts the requirement to make Microsoft Entra ID the authority.
Why C is wrong: Running both paths in parallel feels like a safe incremental step, but it leaves the federation servers in production and a large population outside cloud sign-in evaluation, so the target of retiring federation and evaluating every sign-in is never actually met.
Why D is correct: Switching from federation to Microsoft Entra cloud authentication makes Microsoft Entra ID the authentication authority so risk-based Conditional Access can evaluate every sign-in, and it lets the federation servers be retired while the on-premises directory keeps syncing, which matches the target state precisely.