Account Lockout using Microsoft Entra Connect

Question

Account Lockout using Microsoft Entra Connect

Jessie Cochran 45

We have Microsoft Entra Connect setup and working to sync our accounts from On Prem AD to the cloud. Password hash sync is enabled and things work great. The only thing I cannot seem to figure out is when a users on prem AD account is locked out or the password expires, their access to O365 is still working.

Is there a setting that needs to be enabled so that the online side locks as well?

Thank you

VEMULA SRISAI 14,075 Reputation points Microsoft External Staff Moderator

2026-03-10T12:03:08.96+00:00

Hello Jessie Cochran,

This behavior is expected by design when using Microsoft Entra Connect with Password Hash Synchronization (PHS).

With PHS, only the password hash is synchronized to Microsoft Entra ID. On‑premises account lockout status and password expiration are not synced. As a result, even if a user is locked out or their password expires in on‑prem AD, they may still be able to access Microsoft 365 because authentication happens independently in Entra ID.

If you need on‑prem lockout and password expiration to be enforced for cloud sign‑ins, you must use Pass‑Through Authentication (PTA), where authentication is validated directly against on‑prem AD. Alternatively, disabling the user account on‑prem AD will also block cloud access after sync.

https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-password-hash-synchronization

https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/choose-ad-authn
kagiyama yutaka 5,655 Reputation points

2026-03-10T13:03:55.35+00:00

I think the next gentle step is just disable the on‑prem acct — lockouts don’t travel in this setup, but “disable” makes Entra quietly drop access on its next token check.
Jessie Cochran 45 Reputation points

2026-03-10T13:07:02.5566667+00:00

When a user leaves we do disable the accounts and that isn't a problem because the account gets blocked at that point.

The problem I am referring to is when a user locks out their user account they do not necessarily see that there is an issue because email and teams keep working. The issue doesn't become apparent until they access an on prem resource and are denied.

Would the end user notice anything odd if we enabled the pass thru ?
VEMULA SRISAI 14,075 Reputation points Microsoft External Staff Moderator

2026-03-17T12:23:26.06+00:00
Jessie Cochran No ,in normal operation, end users will not notice anything odd if you enable Pass‑Through Authentication (PTA).

From a user experience perspective:

The Microsoft 365 sign‑in screens remain the same

Outlook, Teams, and portal access behave normally

MFA and Conditional Access continue to work as they do today

The only noticeable change is in the situation you described:

If a user’s on‑prem AD account becomes locked out or the password expires, they will immediately be unable to sign in to Microsoft 365 as well. Email and Teams will stop working until the on‑prem issue is resolved.

This actually improves clarity for users, because:

They immediately realize there is an account issue

They contact IT sooner

There’s no confusion where cloud apps still work but on‑prem resources do not

The main consideration with PTA is availability. Because authentication is validated against on‑prem AD, Microsoft recommends deploying multiple PTA agents for redundancy. With a properly configured setup, the change is generally transparent to users
Jessie Cochran 45 Reputation points

2026-03-17T12:55:28.11+00:00

I went to go thru this and change from Hash to Pass Thru and got a prompt that kind of worried me is this going to change anything that I need to be concerned with?
VEMULA SRISAI 14,075 Reputation points Microsoft External Staff Moderator

2026-03-24T06:11:30.01+00:00

Jessie Cochran I’m following up on my previous response to see if it helped. Please feel free to reach out if you need any further assistance. I’m happy to help

Answer accepted by question author

0 additional answers

Your answer

VEMULA SRISAI 14,075 Reputation points Microsoft External Staff Moderator

2026-03-10T12:03:08.96+00:00

Hello Jessie Cochran,

This behavior is expected by design when using Microsoft Entra Connect with Password Hash Synchronization (PHS).

With PHS, only the password hash is synchronized to Microsoft Entra ID. On‑premises account lockout status and password expiration are not synced. As a result, even if a user is locked out or their password expires in on‑prem AD, they may still be able to access Microsoft 365 because authentication happens independently in Entra ID.

If you need on‑prem lockout and password expiration to be enforced for cloud sign‑ins, you must use Pass‑Through Authentication (PTA), where authentication is validated directly against on‑prem AD. Alternatively, disabling the user account on‑prem AD will also block cloud access after sync.

https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-password-hash-synchronization

https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/choose-ad-authn
kagiyama yutaka 5,655 Reputation points

2026-03-10T13:03:55.35+00:00

I think the next gentle step is just disable the on‑prem acct — lockouts don’t travel in this setup, but “disable” makes Entra quietly drop access on its next token check.
Jessie Cochran 45 Reputation points

2026-03-10T13:07:02.5566667+00:00

When a user leaves we do disable the accounts and that isn't a problem because the account gets blocked at that point.

The problem I am referring to is when a user locks out their user account they do not necessarily see that there is an issue because email and teams keep working. The issue doesn't become apparent until they access an on prem resource and are denied.

Would the end user notice anything odd if we enabled the pass thru ?
VEMULA SRISAI 14,075 Reputation points Microsoft External Staff Moderator

2026-03-17T12:23:26.06+00:00

Jessie Cochran No ,in normal operation, end users will not notice anything odd if you enable Pass‑Through Authentication (PTA).

From a user experience perspective:

The Microsoft 365 sign‑in screens remain the same

Outlook, Teams, and portal access behave normally

MFA and Conditional Access continue to work as they do today

The only noticeable change is in the situation you described:

If a user’s on‑prem AD account becomes locked out or the password expires, they will immediately be unable to sign in to Microsoft 365 as well. Email and Teams will stop working until the on‑prem issue is resolved.

This actually improves clarity for users, because:

They immediately realize there is an account issue

They contact IT sooner

There’s no confusion where cloud apps still work but on‑prem resources do not

The main consideration with PTA is availability. Because authentication is validated against on‑prem AD, Microsoft recommends deploying multiple PTA agents for redundancy. With a properly configured setup, the change is generally transparent to users
Jessie Cochran 45 Reputation points

2026-03-17T12:55:28.11+00:00

I went to go thru this and change from Hash to Pass Thru and got a prompt that kind of worried me is this going to change anything that I need to be concerned with?
VEMULA SRISAI 14,075 Reputation points Microsoft External Staff Moderator

2026-03-24T06:11:30.01+00:00

Jessie Cochran I’m following up on my previous response to see if it helped. Please feel free to reach out if you need any further assistance. I’m happy to help

Answer 1

VEMULA SRISAI 14,075 Microsoft External Staff Moderator

Jessie Cochran This prompt is expected and normal when switching from Password Hash Synchronization to Pass‑Through Authentication (PTA).

What it’s telling you is that Entra Connect will install the PTA authentication agent, enable PTA, and configure Seamless SSO. This does not convert users to cloud‑only, does not reset passwords, and does not change the user sign‑in experience.

For end users, Microsoft 365 sign‑in, Outlook, and Teams behave the same. The key improvement is that on‑prem AD lockouts and password expiration are now enforced immediately for cloud sign‑ins.

The only thing to plan for is availability: Microsoft recommends installing multiple PTA agents for redundancy. With that in place, this change is safe and resolves the behavior you’re seeing by design.

Jessie Cochran 45 Reputation points

2026-03-24T10:19:41.2466667+00:00

Thank you all for the help! I am waiting for my manager to approve the change and we will update to Pass Thru. Appreciate all of the guidance.
VEMULA SRISAI 14,075 Reputation points Microsoft External Staff Moderator

2026-03-24T15:47:40.6566667+00:00

Jessie Cochran If the resolution was helpful, kindly take a moment to click on and click on Yes for was this answer helpful. And, if you have any further query do let us know
Jessie Cochran 45 Reputation points

2026-03-24T23:25:41.02+00:00

Can I ask one more question? If we implement this when a user is locked out will the MS window actually say that they are locked out or will it be something different? Just need to provide our users with what they will see since this will be different than how we have operated for 4 years.