In an identity federation setup between on-premises Active Directory and cloud identities, which practice helps maintain consistent access control across environments?

• A. Disable MFA to reduce friction.
• B. Use only cloud accounts without on-prem identity.
• C. Avoid any group synchronization and rely on user passwords.
• D. Enforce MFA and synchronize groups and roles.

Answer: (D)

When you have a federation between on-premises Active Directory and cloud identities, the goal is to have authentication and authorization decisions feel seamless across environments. That means enforcing a strong, consistent authentication method and making sure the same group and role assignments exist in both places so permissions line up.

Enforcing MFA across the board provides a uniform, stronger check on who is signing in, reducing the risk of compromised credentials and ensuring that access policies apply equally whether users are authenticating on-prem or in the cloud. At the same time, synchronizing groups and roles ensures that membership changes in the on-prem directory are reflected in the cloud, and vice versa, so entitlements and permissions remain aligned. This combination keeps access control consistent and manageable across environments.

Disabling MFA weakens security and creates divergent authentication behavior between on-prem and cloud. Relying only on cloud accounts without the on‑prem identity breaks the federated model and can lead to drift between environments. Not syncing groups and relying on passwords alone creates inconsistent permissions and undermines centralized governance.