Microsoft AZ-600 Practice Test - Questions Answers, Page 5

For multinode systems, the user portal URL is formatted as https://portal.<region>.<FQDN>. For anASDK deployment, the URL is https://portal.local.azurestack.external. In our case we must also direct any foreign principals (users in the Adatum directory without the suffix of adatum.onmicrosoft.com) to sign in using https://<user-portalurl>/ adatum.onmicrosoft.com. If they don't specify the / adatum.onmicrosoft.com directory tenant in the URL, they're sent to their default directory and receive an error that says their administrator hasn't consented.

Reference: https://learn.microsoft.com/en-us/azure-stack/operator/enable-multitenancy

.Synopsis

Gets the health report of identity application in the Azure Stack home and guest directories .DESCRIPTION Gets the health report for Azure Stack identity applications in the home directory as well as guest directories of Azure Stack. Any directories with an unhealthy status need to have their permissions updated.

.EXAMPLE

$adminResourceManagerEndpoint = "https://adminmanagement.local.azurestack.external"$homeDirectoryTenantName = "<homeDirectoryTenant>.onmicrosoft.com"Get-AzsHealthReport -AdminResourceManagerEndpoint $adminResourceManagerEndpoint `-DirectoryTenantName $homeDirectoryTenantName -Verbose

Reference: https://github.com/Azure/AzureStack-

Tools/blob/master/Identity/AzureStack.Identity.psm1

https://github.com/Azure/AzureStack-Tools/blob/master/Identity/README.md

Hybrid Identity Administrator role is now available with Cloud Provisioning Type: New feature Service category: Azure AD Cloud Provisioning Product capability: Identity Lifecycle Management IT Admins can start using the new "Hybrid Admin" role as the least privileged role for setting up Azure AD Connect Cloud Provisioning. With this new role, you no longer have to use the Global Admin role to set up and configure Cloud Provisioning. Note: Hybrid Identity Administrator

Users in this role can create, manage and deploy provisioning configuration setup from AD to Azure AD using Cloud Provisioning as well as manage Azure AD Connect, Pass-through Authentication (PTA), Password hash synchronization (PHS), Seamless Single Sign-On (Seamless SSO), and federation settings. Users can also troubleshoot and monitor logs using this role.

Reference: https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/whats-newarchive

https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#hybrididentity-administrator

Unlocking the privileged endpoint for support scenarios

During a support scenario, the Microsoft support engineer might need to elevate the privileged endpoint PowerShell session to access the internals of the Azure Stack Hub infrastructure. This process is sometimes informally referred to as "break the glass" or "unlock the PEP".

An elevated PEP session has a validity of 8 hours, after which, if not terminated, the elevated PEP session will automatically lock back to a regular PEP session.

Reference: https://learn.microsoft.com/en-us/azure-stack/operator/azure-stack-privileged-endpoint

The Cloud ID is the unique ID for tracking support data uploaded from a specific scale unit. When diagnostic logs are uploaded for support analysis, the Cloud ID is how the logs are associated with that scale unit.

Reference: https://learn.microsoft.com/en-us/azure-stack/operator/azure-stack-find-cloud-id?

Choose an identity store

With a connected deployment, you can choose between Azure AD or AD FS for your identity store. A disconnected deployment, with no internet connectivity, can only use AD FS. Capacity-based billing

If you decide to use the capacity billing model, you must purchase an Azure Stack Hub Capacity Plan SKU based on the capacity of your system. You need to know the number of physical cores in your Azure Stack Hub to purchase the correct quantity.

Capacity billing requires an Enterprise Agreement (EA) Azure subscription for registration. The reason is that registration sets up the availability of items in the Marketplace, which requires an Azure subscription. The subscription isn't used for Azure Stack Hub usage.

Reference: https://learn.microsoft.com/en-us/azure-stack/operator/azure-stack-connecteddeployment

Reference: https://learn.microsoft.com/en-us/azure-stack/operator/azure-stack-rotate-secrets

Download Azure Stack Hub tools from GitHub

AzureStack-Tools is a GitHub repository that hosts PowerShell modules for managing and deploying resources to Azure Stack Hub. If you're planning to establish VPN connectivity, you can download these PowerShell modules to the Azure Stack Development Kit (ASDK), or to a Windows-based external client.

Reference: https://learn.microsoft.com/en-us/azure-stack/operator/azure-stack-powershelldownload