Where can I validate the encryption used for passwords within Azure AD?

Question

I have an okay understanding of how passwords are stored and secured for on-prem Active Directory. However, how are they stored/encrypted for a fully cloud environment utilizing Azure Active Directory?

Answer 1

There's no way for you to directly validate this, you can only trust the information Microsoft is providing: https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-password-hash-synchronization#detailed-description-of-how-password-hash-synchronization-works

Answer 2

Page 16 of https://aka.ms/aaddatawhitepaper

Hash: Password Key Derivation
Function 2 (PBKDF2), using HMAC SHA256 @ 1000 iterations

For password hash sync, the on premises account password hash is
salted and rehashed. Cloud account
passwords are salted and hashed.
The resulting one-way hash derived
from this operation is encrypted at rest
(see the "Secret encryption at rest" row
of this table for details).
It is important to note that only this
derivative is stored in the cloud service.