AZ-305 Design infrastructure solutions Practice Question
A company needs to implement a hybrid identity solution that allows users to access both on-premises applications and Microsoft 365 using a single identity. The company has on-premises Active Directory Domain Services (AD DS). They want to synchronize identities to the cloud while also enabling password writeback for self-service password reset. Which Azure service should they use?
⚠ Common exam trap
Watch out — candidates often confuse Microsoft Entra Connect (the sync tool) with Microsoft Entra ID (the cloud directory) or Microsoft Entra Domain Services (a managed domain service), leading them to select the wrong service for hybrid identity synchronization and password writeback.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra Connect
Microsoft Entra Connect (formerly Azure AD Connect) is the correct tool for synchronizing on-premises AD DS identities to Microsoft Entra ID while enabling password writeback for self-service password reset (SSPR). It supports the required hybrid identity scenarios, including password hash synchronization or pass-through authentication, and can be configured to write passwords back to on-premises AD DS via the SSPR writeback feature.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Entra ID
Why it's wrong here
Microsoft Entra ID is the cloud-based identity and access management directory itself, not a synchronization engine. While it stores synchronized user objects and can be the target of hybrid sync, it does not connect to on-premises Active Directory to copy passwords or support password writeback on its own. Any writeback capability that exists is carried out by another component, not by the directory service.
- ✗
Microsoft Entra Connect Health
Why it's wrong here
Microsoft Entra Connect Health is solely a monitoring, alerting, and reporting service for the synchronization infrastructure and Active Directory Federation Services—it is not a data synchronization or password writeback engine. It provides health metrics, duplicate attribute detection, and authentication insights but never moves identity data between directories. Enabling Connect Health has no effect on implementing hybrid identity or writeback.
- ✓
Microsoft Entra Connect
Why this is correct
Microsoft Entra Connect is the correct on-premises synchronization tool that bridges on-premises Active Directory and Microsoft Entra ID, performing password hash sync, pass-through authentication, and, when properly configured with the required Microsoft Entra ID Premium license, password writeback. When a user resets a password in the cloud, Entra Connect receives that reset securely, encrypts it, and updates the on-premises AD password, ensuring the new credential works immediately for both on-premises and cloud authentication.
- ✗
Microsoft Entra Domain Services
Why it's wrong here
Microsoft Entra Domain Services provides managed domain capabilities such as domain join, Group Policy, LDAP, Kerberos, and NTLM, but it does not synchronize identities from on-premises AD to Microsoft Entra ID. In fact, it receives identity synchronization from Microsoft Entra ID (which may originate through Entra Connect), but it is not the tool that performs the initial on-prem-to-cloud sync nor does it support password writeback. Therefore, it cannot fulfill the hybrid identity and writeback requirement.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-305 question from scratch — 212 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.