Microsoft 365 Certified: Administrator ExpertImplement and manage Microsoft Entra IDMedium
A company is migrating its on-premises Active Directory users to Microsoft Entra ID. The company requires that users continue to use their existing on-premises credentials to access cloud resources, and password hashes must not be synchronized to Microsoft Entra ID for security reasons. Users should experience a seamless sign-on experience from corporate-joined devices. Which authentication method should you implement?
- AMicrosoft Entra Kerberos
- BPass-through Authentication (PTA)
- CPassword Hash Synchronization (PHS)
- DFederation with Active Directory Federation Services (AD FS)
Show answer & explanationAnswer & explanation
Correct answer: B. Pass-through Authentication (PTA)
Pass-through Authentication (PTA) allows users to sign in to both on-premises and cloud applications using the same passwords. It achieves this by validating users' passwords directly against their on-premises Active Directory without synchronizing password hashes to Microsoft Entra ID, fulfilling the security requirement. It also provides a seamless sign-on experience.
Why the other options are wrong
- A. Microsoft Entra Kerberos is for hybrid identity scenarios with Kerberos-based authentication to cloud resources, not for the primary user authentication method to Microsoft Entra ID itself.
- C. PHS synchronizes password hashes, which violates the requirement that hashes must not be synchronized.
- D. AD FS federation also meets the requirements but is more complex to implement and manage than PTA.
Pass-through Authentication (PTA)
Microsoft Entra Pass-through Authentication (PTA) is a sign-in method that allows users to sign in to both on-premises and cloud-based applications using the same passwords.
- No password hashes are stored in Microsoft Entra ID.
- Authenticates users directly against on-premises Active Directory.
- Requires lightweight agents on on-premises servers.
Memory trick: PHS is 'Password Hash Sync,' PTA 'Pass Through All,' AD FS 'Federates Directories Fully.'