Azure Password Hash Sync & Password Pass-thru Authentication Versus ADFS Authentication

Question

Hello. I would like to get your insight about running password pass-through(PTA) and password hash sync(PHS) authentication versus the ADFS authentication especially on the financial or cost factor when running these system. Background is we are turning away to ADFS auth and are choosing between PTA and PHS but we want to compare about the cost of these system to run. Do you have an idea where and what should I start gathering information on this? I am thinking to get the total resources that we had invested in ADFS(onprem servers, VM, bare-metal, licenses, etc.) and then compare it with PTA and PHS.

Answer 1

@Monde Bread Admin

Thank you for reaching out to us.

Usually, when you talk about ADFS for authentication, it means user authentication happens in on-premises via ADFS. Where ADFS acts as an identity provider. When you use ADFS in your environment, you need minimum of 2 servers (1 ADFS and 1 WAP). If you want to implement high availability then depending on the load you increase the server to 4, 6, 8 etc.

So, in ADFS environment the number of servers are more.
In terms of cost, there is no cost utilized for the authentication via ADFS. Cost comes into picture only when you deploy more and more servers.

When you talk about PTA (pass through authentication), authentication happens in on-premises through authentication connector. This authentication connector is by default installed in AD connect server. If you are looking for high availability then you will have to install the connector on another server. This reduces number of servers in on-premises. In this as well there is no extra cost involved for authentication requests.

And about password hash sync, in this authentication happens in Azure. User password get’s synced from on-premises to Azure AD. When user tries to access any Azure resources, authentication happens in Azure AD. Password get’s synced to Azure AD via AD connect. There is only 1 or 2 servers required for PHS. In on-premises you only required maximum of 2 servers for passwords to be synced to Azure AD.
In this as well there is no extra cost involved for authentication requests.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.