Hello Everyone,
I believe I got the answer to my queries. Please correct me if anyone of you finds anything wrong. I am sharing this so it could help others.
1) MIM/PAM SharePoint 2016 High Availability
We can use SharePoint 2016 farm and can go with SharePoint 2016 servers installed on each MIM Service/Portal server. Using SharePoint farm increase the complexity in the environment and downtime is required when patching/updating the MIM servers. SharePoint
2016 is not free and we can install Standalone on each MIM Portal/Service server which is easy to maintain but it requires an extra licensing cost.
The link below helped me in understanding the impact.
http://blog.ilmbestpractices.com/2018/03/to-farm-or-not-to-farm-part-2.html
when we patch MIM Service it will update the database and the MIM Service. At that instant only updated MIM Service instances should talk to the database (they might work, but no guarantees), and only updated Portals
should talk to the update MIM Service Instance. So I think we still end up with downtime, the key is to minimize it. The Zero downtime patching would certainly reduce it when you patch the actual SharePoint binaries. But we could accomplish the same thing
with two single server farms load balanced through NLB.
2) PAM MFA (Bastion Forest)
MFA supports 2 usage model, Per user and per Authentication.
For PAM deployments, it is best to use
per Authentication model for MFA Provider in Azure AD. It allows you to use MFA with PAM without syncing users with the Azure AD and will keep security maintained.
Thanks,
