AZ-500 Secure identity and access Practice Question
Your company is migrating from on-premises Active Directory to Microsoft Entra ID. You need to synchronize user accounts and enable self-service password reset (SSPR) for cloud users. You have set up Microsoft Entra Connect Sync. Which additional configuration is required to allow password writeback for SSPR?
⚠ Common exam trap
A common mix-up: candidates assume password hash synchronization (PHS) alone enables writeback, but PHS only handles one-way hash flow to the cloud, while writeback is a separate bidirectional feature requiring explicit enablement and licensing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable password writeback in Microsoft Entra Connect and assign Microsoft Entra ID Premium licenses
Password writeback requires both the feature to be enabled in Microsoft Entra Connect (via the synchronization settings) and Microsoft Entra ID Premium licenses (P1 or P2) assigned to users. Without the license, the SSPR writeback functionality is not available, even if the feature is enabled in the sync tool. This combination allows password changes from the cloud to be written back to on-premises Active Directory.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable password writeback in Microsoft Entra Connect and assign Microsoft Entra ID Premium licenses
Why this is correct
Password writeback is an optional feature in Microsoft Entra Connect that must be explicitly enabled in the configuration wizard, and it requires Microsoft Entra ID P1 or P2 licenses to be assigned to users. When enabled, password changes performed in Microsoft Entra ID (for example, via self-service password reset) are written back to on-premises Active Directory, making the hybrid password bidirectional. This is the only mechanism that fulfills the requirement of writing back passwords from the cloud to on-premises.
- ✗
Configure pass-through authentication
Why it's wrong here
Pass-through authentication (PTA) only validates user passwords against on-premises Active Directory in real time via a lightweight agent; it does not write any changes back. The connection is strictly one-way for authentication, and while PTA can coexist with writeback, enabling PTA by itself does not enable the writeback feature. To support writeback, you still need the dedicated writeback feature in Entra Connect plus Premium licenses.
- ✗
Enable password hash synchronization
Why it's wrong here
Password hash synchronization (PHS) derives a hash of the on-premises password hash and synchronizes that hash to Microsoft Entra ID for cloud sign-in. Because this is a one-way sync and the original password is never transmitted, PHS cannot reverse the process or push password changes back to on-premises Active Directory. Enabling PHS alone therefore does not provide any writeback capability.
- ✗
Install the Microsoft Entra ID Password Protection proxy
Why it's wrong here
The Microsoft Entra ID Password Protection proxy is an on-premises relay that forwards password validation requests to the Microsoft Entra ID Password Protection service, which enforces banned-password lists. Its purpose is to prevent users from setting weak passwords during on-premises password changes, not to synchronize or write back passwords. This proxy has no writeback functionality and operates independently of the directory synchronization engine.
Visual reference
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 617-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.