AZ-305 Practice Question: Design identity, governance, and monitoring solutions
A company is migrating on-premises Windows applications that require LDAP, NTLM, or Kerberos authentication to Azure VMs. They want to provide domain services for these applications without deploying and managing domain controllers. Which Azure service should they use?
⚠ Common exam trap
Test-takers frequently confuse Microsoft Entra ID (a modern identity provider) with Microsoft Entra ID Domain Services (which provides legacy protocol support), leading them to incorrectly select Entra ID for LDAP/NTLM/Kerberos needs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID Domain Services
Microsoft Entra ID Domain Services (formerly Azure AD DS) provides managed domain services such as LDAP, NTLM, and Kerberos authentication without requiring you to deploy, patch, or manage domain controllers. It integrates with your existing Microsoft Entra tenant and supports group policy, domain join, and legacy authentication protocols needed by the on-premises Windows applications being migrated to Azure VMs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Entra ID
Why it's wrong here
Microsoft Entra ID (formerly Azure AD) is a cloud-native identity and access management service that authenticates users via OAuth 2.0, OIDC, and SAML. It does not expose an LDAP interface or accept LDAP binds, and it does not support NTLM integrated authentication. Because the legacy Windows applications require these directory protocols, Entra ID alone cannot satisfy the authentication requirement.
- ✓
Microsoft Entra ID Domain Services
Why this is correct
Microsoft Entra ID Domain Services (AAD DS) provides a fully managed Windows Server Active Directory-compatible domain controller that is synchronized from Entra ID. It natively supports LDAP, including secure LDAP (LDAPS), and NTLM/Kerberos authentication, making it the intended choice for lifting and shifting on-premises apps that need an AD-joined infrastructure. Microsoft handles patching, availability, and domain controller replication, eliminating the administration burden.
- ✗
Active Directory on Azure VMs
Why it's wrong here
Deploying Active Directory on Azure VMs requires provisioning one or more Windows Server instances as domain controllers, using Azure availability sets or Availability Zones for high availability, and continuously applying security patches. This IaaS approach gives full control but demands significant ongoing operational overhead, including domain controller maintenance, backups, monitoring, and disaster recovery. Because AAD DS already provides a managed AD domain with no such administrative duties, the IaaS route is technically feasible but violates the stated preference for minimal management.
- ✗
Microsoft Entra ID B2C
Why it's wrong here
Microsoft Entra ID B2C is an externally facing customer identity and access management service specialized in sign-up, sign-in, and social identity providers such as Facebook and Google. It has no LDAP server endpoints and does not support the NTLM or Kerberos authentication flows used by legacy enterprise Windows applications. Using it here would require the applications to be rearchitected to OIDC, which is inappropriate for an LDAP-based lift-and-shift migration.
Go deeper
Related to this question
About these practice questions
This AZ-305 question is part of Courseiva's 795-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.