Can someone please explain this alert to me?

Question

Can someone please explain this alert to me?

Dhruvil Shah 1

What does password hash sync mean?

1 answer

Your answer

Answer 1

James Hamil 27,221 Microsoft Employee Moderator

Hi @Dhruvil Shah , from this document: https://learn.microsoft.com/en-us/azure/active-directory/hybrid/whatis-phs

Password hash synchronization is one of the sign-in methods used to accomplish hybrid identity. Azure AD Connect synchronizes a hash, of the hash, of a user's password from an on-premises Active Directory instance to a cloud-based Azure AD instance.

Password hash synchronization is an extension to the directory synchronization feature implemented by Azure AD Connect sync. You can use this feature to sign in to Azure AD services like Microsoft 365. You sign in to the service by using the same password you use to sign in to your on-premises Active Directory instance.

What questions do you have about it? I'd be happy to answer any you may have!

Best,
James

Dhruvil Shah 1 Reputation point

2021-09-09T23:36:27.683+00:00

Thanks James! I understand that part. We had some unusual activities on a user account. Why does it say "failed" under multi-factor authentication. Does that mean the attacker had the right password? or does that mean a wrong password was used. I'm just trying to understand the sequence on what happened to that user account. In able to trigger MFA wouldn't you need a right password first? Thanks for your quick response.
James Hamil 27,221 Reputation points Microsoft Employee Moderator

2021-09-14T21:54:34.393+00:00

Hi @Dhruvil Shah , sorry for the delay in response! Have you seen this document? You can download the logs and see exactly what failed. If no info comes up on the download please let me know.

Best,
James

Share via

Can someone please explain this alert to me?

1 answer

Your answer