HOTSPOT Your network contains an on-premises Active Directory Domain Services (AD DS) domain named contoso.com that syncs with an Azure AD tenant. The tenant contains a group named Group1 and the users shown in the following table. https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/Microsoft_AZ-800/page_222_img_2.jpg Domain/OU filtering in Azure AD Connect is configured as shown in the Filtering exhibit. (Click the Filtering tab.) https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/Microsoft_AZ-800/page_223_img_1.jpg You review the Azure AD Connect configurations as shown in the Configure exhibit. (Click the Configure tab.) https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/Microsoft_AZ-800/page_224_img_1.jpg For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/Microsoft_AZ-800/page_224_img_2.jpg

Its D, User1, User3 and User4. Official doc and labs cover these group permissions pretty well if you want to check deeper.

If Contoso\Remote Management Users had been added locally, B could fit. But going by defaults, it's C.

Question 16 - Microsoft Azure AZ-800 Real Exam Questions [March 2026 Update]

Q: 16

HOTSPOT Your network contains an on-premises Active Directory Domain Services (AD DS) domain named contoso.com that syncs with an Azure AD tenant. The tenant contains a group named Group1 and the users shown in the following table. Domain/OU filtering in Azure AD Connect is configured as shown in the Filtering exhibit. (Click the Filtering tab.) You review the Azure AD Connect configurations as shown in the Configure exhibit. (Click the Configure tab.) For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Your Answer

Correct Answer:

USER1 CAN USE SELF-SERVICE PASSWORD RESET (SSPR) TO RESET HIS PASSWORD: YES

IF USER1 CONNECTS TO MICROSOFT EXCHANGE ONLINE, AN ON-PREMISES DOMAIN CONTROLLER PROVIDES AUTHENTICATION: YES

YOU CAN ADD USER2 TO GROUP1 AS A MEMBER: NO

Explanation

Yes: User1 is located in OU1, which is selected for synchronization in the "Domain and OU filtering" settings. Consequently, the user identity exists in Azure AD. The "Ready to configure" screen shows that Password writeback is enabled. Password writeback is a prerequisite for Self-Service Password Reset (SSPR) to function for synchronized users.

Yes: The configuration shows that Pass-through authentication (PTA) is being enabled. In the PTA method, when a user signs in, the password is validated directly against the on-premises Active Directory Domain Controller by an authentication agent. This contrasts with Password Hash Sync, where authentication occurs in the cloud.

No: User2 is located in OU2. In the "Domain and OU filtering" settings, OU2 is unchecked, meaning User2 is filtered out and not synchronized to the Azure AD tenant. You cannot add a user to an Azure AD group (Group1) if that user object does not exist in the Azure AD directory.

References

Microsoft Learn - Microsoft Entra Connect sync: Configure filtering:

Section: Domain and OU-based filtering

"The domain and OU-based filtering option allows you to select specific domains and OUs to synchronize... If an OU is not selected, the users and groups in that OU are not synchronized."

URL: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sync-configure-filtering#domain-and-ou-based-filtering

Microsoft Learn - User sign-in with Microsoft Entra Pass-through Authentication:

Section: Feature highlights

"Pass-through Authentication validates users' passwords directly against your on-premises Active Directory."

URL: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-pta

Microsoft Learn - Tutorial: Enable Microsoft Entra self-service password reset writeback:

Section: Enable password writeback in Microsoft Entra Connect

Confirming that enabling the "Password writeback" option in the synchronization settings is the required step to allow password changes in the cloud to be written back to the on-premises directory.

URL: https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr-writeback

Premium Access Includes

FLASH OFFER

avail 10% DISCOUNT on YOUR PURCHASE