Microsoft 365 Certified: Administrator ExpertImplement and manage Microsoft Entra IDMedium
A consultant is helping a client migrate user identities to Microsoft Entra ID. The client has an existing on-premises Active Directory Domain Services (AD DS) environment. They want to ensure that if the internet connection to their on-premises network fails, users can still sign in to Microsoft 365 services using their cached credentials. Which Microsoft Entra Connect authentication method provides this capability?
- APass-through Authentication (PTA)
- BFederation (AD FS)
- CHybrid Azure AD Join
- DPassword Hash Synchronization (PHS)
Show answer & explanationAnswer & explanation
Correct answer: D. Password Hash Synchronization (PHS)
Password Hash Synchronization (PHS) stores a hash of the user's password in Microsoft Entra ID. If the on-premises Active Directory or internet connection fails, Microsoft Entra ID can still authenticate users directly using the stored password hash, allowing access to Microsoft 365 services.
Why the other options are wrong
- A. PTA relies on agents to forward authentication requests to on-premises AD DS, so it would fail without internet connectivity to the agents or if on-premises AD DS is unavailable.
- B. Federation with AD FS relies entirely on the on-premises AD FS infrastructure, which would be unavailable without an internet connection to the AD FS servers.
- C. Hybrid Azure AD Join relates to device management, not the primary user authentication method for cloud services during an outage.
Password Hash Synchronization (PHS) Resilience
PHS allows Microsoft Entra ID to authenticate users even if the on-premises Active Directory is unavailable or experiencing connectivity issues.
- Synchronizes a cryptographic hash of the user's password from on-premises AD to Microsoft Entra ID.
- Microsoft Entra ID performs authentication directly using this hash.
- Provides high availability for cloud sign-ins even during on-premises outages.
Memory trick: Resilient Auth: Sync Hashes, Stay Strong Online.