Hotspot Question
Your on-premises network contains an Active Directory Domain Services (AD DS) forest. The forest contains a top-level domain, three child domains, and an on-premises server named Server1.
You have a Microsoft Entra tenant. Server1 uses Microsoft Entra Connect Sync to replicate all the user objects from the three child domains to the tenant.
New contractors and employees are onboarded manually by using the Workday cloud-based human resources (HR) application.
You plan to automatically provision accounts for new users in one of the on-premises child domains and the Microsoft Entra tenant. The provisioning logic for the employees will be distinct from the provisioning logic for the contractors.
You need to identify the following:
- The minimum number of apps to register in the Microsoft Entra tenant
- The minimum number of Microsoft Entra Connect provisioning agents to
deploy
The solution must minimize implementation effort.
What should you identify? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Correct Answer:

Explanation:
Box 1: 3
One app per child domain. We have three child domains.
Box 2: 2
Two for each disjoint forest. We have one forest.
Note: Microsoft Entra, Microsoft Entra ID, App provisioning, Cloud HR application to Microsoft Entra user provisioning Scenario: Single cloud HR app tenant -> target multiple child domains in a disjoint Active Directory forest

This scenario involves provisioning users from the cloud HR app to domains in disjoint Active Directory forests.
We recommend the following production configuration:
* Number of Microsoft Entra Connect provisioning agents to deploy on-premises Two per disjoint Active Directory forest.
* Number of provisioning connector apps to configure
One app per child domain.
Reference:
https://learn.microsoft.com/en-us/entra/identity/app-provisioning/plan-cloud-hr-provision