Microsoft 365 Certified: Administrator ExpertImplement and manage Microsoft Entra IDHard
A consultant is helping a client migrate user identities to Microsoft Entra ID. The client has chosen Password Hash Synchronization (PHS) as the authentication method. The client is concerned about the availability of authentication services during potential outages of the primary Microsoft Entra Connect server. You need to ensure that PHS remains resilient and available even if the primary server fails. What should you recommend?
- ADeploy a second Microsoft Entra Connect server in staging mode.
- BImplement Active Directory Federation Services (AD FS) for failover.
- CConfigure multiple Pass-through Authentication agents.
- DEnable Seamless Single Sign-On (SSO) on all domain controllers.
Show answer & explanationAnswer & explanation
Correct answer: A. Deploy a second Microsoft Entra Connect server in staging mode.
To ensure resiliency and high availability for Password Hash Synchronization, you should deploy a second Microsoft Entra Connect server in staging mode. While only one server actively exports to Microsoft Entra ID, both servers perform PHS, thus providing immediate failover capability for password hash synchronization if the primary server becomes unavailable.
Why the other options are wrong
- B. AD FS is a completely different authentication method and would replace PHS, not provide failover for it.
- C. PTA agents are for Pass-through Authentication, not PHS, and are irrelevant to PHS resilience.
- D. Seamless SSO enhances user experience but does not provide resilience for the underlying PHS synchronization process itself.
Password Hash Synchronization (PHS) Resilience
Ensuring continuous availability of password hash synchronization to Microsoft Entra ID by deploying redundant Microsoft Entra Connect infrastructure.
- Achieved by deploying a second Microsoft Entra Connect server in staging mode.
- Both primary and staging servers perform PHS to Microsoft Entra ID simultaneously.
- If the primary server fails, the staging server can be promoted to active with minimal downtime for synchronization.
- Ensures users can continue to authenticate even if one sync server is down.
Memory trick: PHS Resilience: Prepare a Partner Server.