SSO Design for Hybrid Identity | Azure AZ-305

While preparing for the AZ-305: Designing Microsoft Azure Infrastructure Solutions exam, many candidates struggle with selecting the right single sign-on (SSO) method for legacy applications during identity modernization projects. In the enterprise world, this decision often hinges on balancing ease of integration, security posture, and compatibility with Azure Active Directory capabilities. Let’s drill into a simulated enterprise migration scenario.

The Scenario

#

Tailwind Manufacturing is a traditional enterprise with a legacy HR vacation request application used by approximately 6,000 employees worldwide. The application currently manages its own user credential store and requires users to enter usernames and passwords manually—there is no integration with any identity provider. The company is embarking on a cloud transformation journey aligned with the Microsoft Cloud Adoption Framework, aiming to modernize authentication by upgrading the application to support Azure Active Directory-based single sign-on (SSO).

The IT team plans to register the application in Azure AD and enable SSO capabilities to improve security, reduce password fatigue, and centralize identity governance. The application does not currently support modern authentication protocols natively.

Key Requirements

#

Identify the best SSO method to enable Azure AD authentication for this legacy application without rewriting the application to support SAML or OpenID Connect protocols, while ensuring seamless user sign-in experience.

The Options

#

• A) Header-based authentication
• B) SAML (Security Assertion Markup Language)
• C) Password-based SSO
• D) OpenID Connect (OIDC)

Correct Answer

#

C) Password-based SSO.

Step-by-Step Winning Logic

#

Password-based SSO in Azure AD Application Proxy or Azure AD SSO allows enterprises to integrate legacy applications that do not understand federation protocols like SAML or OpenID Connect by securely handling user credentials behind the scenes. This keeps the user experience seamless, enables centralized credential management, and supports corporate compliance requirements.

From a Well-Architected Framework perspective:

• Security: Credentials are never stored in clear text in Azure AD; they are securely managed and protected. Reduces password fatigue and phishing risks by enabling conditional access policies.
• Operational Excellence: Minimizes application changes and accelerates migration timelines.
• Reliability: Provides high availability through Azure AD infrastructure.
• Cost Optimization: Avoids rewriting or replacing legacy apps immediately.
• Performance Efficiency: Leverages existing protocols with minimal overhead.

💎 Professional-Level Analysis

#

This section breaks down the scenario from a professional exam perspective, focusing on constraints, trade-offs, and the decision signals used to eliminate incorrect options.

🔐 Expert Deep Dive: Why Options Fail

#

This walkthrough explains how the exam expects you to reason through the scenario step by step, highlighting the constraints and trade-offs that invalidate each incorrect option.

Prefer a quick walkthrough before diving deep?
[Video coming soon] This short walkthrough video explains the core scenario, the key trade-off being tested, and why the correct option stands out, so you can follow the deeper analysis with clarity.

🔐 The Traps (Distractor Analysis)

#

This section explains why each incorrect option looks reasonable at first glance, and the specific assumptions or constraints that ultimately make it fail.

The difference between the correct answer and the distractors comes down to one decision assumption most candidates overlook.

🔐 The Solution Blueprint

#

This blueprint visualizes the expected solution, showing how services interact and which architectural pattern the exam is testing.

Seeing the full solution end to end often makes the trade-offs—and the failure points of simpler options—immediately clear.

graph TD
    User([User Browser]) -->|Access app URL| AzureAD[Azure Active Directory]
    AzureAD -->|Authenticate user| User
    AzureAD -->|Provide SSO token| AppProxy[Azure AD Application Proxy]
    AppProxy -->|Injects credentials securely| LegacyApp[Legacy Vacation App Server]
    LegacyApp -->|Processes request| Database[(App DB)]
    style AzureAD fill:#0078D4,stroke:#333,color:#fff
    style AppProxy fill:#68217A,stroke:#333,color:#fff
    style LegacyApp fill:#5C2D91,stroke:#333,color:#fff

🔐 The Decision Matrix

#

This matrix compares all options across cost, complexity, and operational impact, making the trade-offs explicit and the correct choice logically defensible.

At the professional level, the exam expects you to justify your choice by explicitly comparing cost, complexity, and operational impact.

🔐 Real-World Practitioner Insight

#

This section connects the exam scenario to real production environments, highlighting how similar decisions are made—and often misjudged—in practice.

This is the kind of decision that frequently looks correct on paper, but creates long-term friction once deployed in production.