When selecting between user forest and resource forest for synchronization, what describes their difference? Select two.

• A. Resource forest only synchronizes users created in Azure AD
• B. User forest synchronizes user accounts in on-premises AD
• C. Resource forest synchronizes all attributes from on-premises AD
• D. User forest supports guest user access

Answer: (B)

User forest and resource forest are important concepts in the context of directory synchronization with Azure Active Directory. Understanding the distinction between these two types of forests is crucial when planning for user identity management in hybrid environments.

The user forest is primarily focused on synchronizing user accounts that are created in the on-premises Active Directory (AD) to Azure AD. This includes both user attributes and where those accounts are managed. In a user forest configuration, all user accounts that exist in the on-premises AD can be synchronized, allowing centralized management of these accounts, which is essential for organizations that require their users to authenticate against their on-premises services as well as Azure services.

On the other hand, a resource forest provides a different approach where the focus is on accessing resources rather than managing user identities. It synchronizes identity information for resources but not necessarily user accounts in the same way a user forest does. For example, a resource forest might be used to manage applications or resources that need to be accessed by users, without needing to sync the user accounts directly.

The other choices reflect characteristics that aren’t accurate representations of these forests' capabilities. For instance, the resource forest does not limit its synchronization to only Azure AD users and does not synchronize all attributes. Furthermore, user