A security engineer is implementing Microsoft Entra ID Password Protection to prevent users and AI automation scripts from using weak or organization-specific banned passwords when rotating credentials. The organization has an on-premises Active Directory. Which component must be deployed to extend Entra ID Password Protection to on-premises AD?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because Microsoft Entra ID Password Protection for on-premises Active Directory requires two components: the Entra ID Password Protection proxy service (installed on domain-joined servers to communicate with Entra ID) and the DC agent installed on each domain controller. The DC agent enforces the banned password list (both Microsoft's global list and the organization's custom banned passwords) during all password change operations on the domain controller.
Full explanation below image
Full Explanation
B is correct because Microsoft Entra ID Password Protection for on-premises Active Directory requires two components: the Entra ID Password Protection proxy service (installed on domain-joined servers to communicate with Entra ID) and the DC agent installed on each domain controller. The DC agent enforces the banned password list (both Microsoft's global list and the organization's custom banned passwords) during all password change operations on the domain controller. A is incorrect because Microsoft Entra Connect password writeback synchronizes passwords from Entra ID to on-premises AD; it does not extend Entra ID Password Protection enforcement to on-premises AD password changes. C is incorrect because Microsoft Identity Manager is an identity management platform and is not required or used for Entra ID Password Protection deployment. D is incorrect because Microsoft Entra Kerberos server enables passwordless and FIDO2 authentication for on-premises resources, not password protection enforcement.