Microsoft 365 Certified: Administrator ExpertImplement and manage Microsoft Entra IDMedium
A company is implementing Microsoft Entra Connect in a new hybrid environment. The security team wants to enable a seamless single sign-on experience for users accessing cloud applications, without exposing any on-premises domain controllers directly to the internet. They also prefer a solution that minimizes infrastructure overhead compared to a full federation solution. Which authentication method, combined with Seamless SSO, should be implemented?
- APassword Hash Synchronization (PHS)
- BPass-through Authentication (PTA)
- CCloud Kerberos Trust
- DFederation with AD FS
Show answer & explanationAnswer & explanation
Correct answer: A. Password Hash Synchronization (PHS)
Password Hash Synchronization (PHS) is the simplest authentication method for hybrid environments that provides a seamless SSO experience when combined with Microsoft Entra Seamless SSO. It minimizes infrastructure overhead compared to AD FS and doesn't require agents or direct domain controller exposure like PTA.
Why the other options are wrong
- B. PTA requires authentication agents that need to communicate with domain controllers, which, while not direct internet exposure, adds a component compared to PHS.
- C. Cloud Kerberos Trust is related to Windows Hello for Business and on-premises resource access, not the primary authentication method for cloud apps in this context.
- D. Federation with AD FS involves significant infrastructure overhead, which the company wants to minimize.
Password Hash Synchronization (PHS)
Password Hash Synchronization (PHS) is a method of signing in to Microsoft Entra ID by synchronizing a cryptographic hash of a user's on-premises Active Directory password to Microsoft Entra ID. It's the simplest way to enable hybrid identity.
- Simplest hybrid authentication method.
- Provides cloud resilience if on-premises AD is unavailable.
- Can be combined with Seamless SSO for enhanced UX.
Memory trick: Hybrid Access: Pick Your Path