Password hash sync VS Pass through authentication

Question

Password hash sync VS Pass through authentication

JohnKings-4069 20

After reviewing some az500 exams questions I would to clarify once a password is reset from an on premise server using the password hash method does it initially go through on prem servers before syncing to Azure AD cloud or does this only apply with the pass through authentication.

Accepted answer

2 additional answers

Your answer

Answer 1

Andy David - MVP 157.4K MVP Volunteer Moderator

On-prem changes are handled by the on-prem domain controllers, then the hash is synced to Azure in that scenario

https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-password-hash-synchronization

User's image

Answer 2

TP 124.7K Volunteer Moderator

Hi,

When you change Active Directory Domain Services password via an on premises workstation/server the change is made to on premises domain controller and then synced to Azure AD. This is true for both password hash sync and pass through authentication.

If the above is helpful please click Accept Answer.

Thanks.

-TP

JohnKings-4069 20 Reputation points

2023-02-21T00:34:37.02+00:00

So then to confirm this practice exam question below is outdated? I answered true but it was false, the explanation is below as well. The security department has requested that when configuring Single Sign On (SSO) for hybrid users that all user passwords are passed through the on-premises Active Directory domain controller for validation.
Solution: You configure Password Hash Sync and enable single sign on (SSO) with the ADConnect tool.
Does this solution meet the goal? True or False.. It's marked as false - False is correct as you will need to configure “Pass through Authentication” as this option allows user passwords to be passed through to the on-premises AD domain controller for validation.
Andy David - MVP 157.4K Reputation points MVP Volunteer Moderator

2023-02-21T12:23:34.3633333+00:00

That is actually false and it refers to the authentication piece. All auth when using PHS will be in Azure, not on-prem. However, in the scenario of a user changing their password on-prem, then the on-prem DCs will handle that and the password hash will be synced to Azure. Hope that makes sense.

Answer 3

Chetan Prajapati 5

Simple logic would be,

- Pass-through authentication validates user passwords directly against the on-premises Active Directory, without using a synced password hash.

- Password hash synchronization synchronizes a hash of the hash of a user’s password from an on-premises Active Directory instance to Azure AD, using a more secure SHA256 password data

Share via

Password hash sync VS Pass through authentication

2 additional answers

Your answer