Office 365 Authentication when AD Connect is offline

Question

We have a Office365 tenant with Azure AD Free and AD Connect Synchronization services running. AD Connect has password Hash Synchronization enabled. We've noticed that if the server running ad connect is turned off then users have issues authenticating to webmail or receiving updates on their phone. although some users continue to get updates We have a planned power outage for the end of December. Is there a setting or change we need to implement so that they can continue to use webmail while our local datacenter is turned off?

The last time we had an outage (due to a flood) some users could still access email on their phone (mostly ios mail app) but not all. As time progressed, more users had the issue.

Answer 1

@Mike Compton Password Hashsync allows the users to sign into cloud services irrespective of on-premise server status. IF a users password has been sync it is set to never expire in cloud and the user should be able to use the cloud service even when the on-prem DC is down.

Coming to your scenarios, there must have been other issues which might have caused the users for not being able to sign in.

As a preventive measure, you can try suggesting your users to use this keep me signed in box when signing in to the cloud services protected by Azure AD, This selection sets a session cookie that bypasses authentication for 180 days.

Read more here : https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-password-hash-synchronization

-----------------------------------------------------------------------------------------------------------------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

Answer 2

Thanks for the reply. Is there a way we can check to see if Asure is receiving the password hash? I know it is set up to send it with ADConnect. Would it make a difference if they use modern Auth vs basic Auth? Out datacenter isn't down often but in the past we've had some people that could access their email and others that cannot.

Answer 3

The Azure Audit logs will show whats being updated for a specific user, but I prefer to use the builtin AADConnect PHS troubleshooter:

https://learn.microsoft.com/en-us/azure/active-directory/hybrid/tshoot-connect-password-hash-synchronization

Its real important to be at the latest AADConnect version as well.