Microsoft 365 Certified: Administrator ExpertImplement and manage Microsoft Entra IDEasy
A company is planning to implement Microsoft Entra ID for identity management. They have an existing on-premises Active Directory Domain Services (AD DS) environment. The security team has a strict requirement that no user passwords should ever be stored or synchronized to the cloud, even in hashed form. They also require that users authenticate directly against the on-premises AD DS environment for all cloud services. Which Microsoft Entra Connect authentication method should you recommend to meet these requirements?
- AFederation with AD FS
- BMicrosoft Entra Seamless Single Sign-On (Seamless SSO)
- CPass-through Authentication (PTA)
- DPassword Hash Synchronization (PHS)
Show answer & explanationAnswer & explanation
Correct answer: C. Pass-through Authentication (PTA)
Pass-through Authentication (PTA) is designed to validate user passwords against the on-premises Active Directory directly, without storing any password hashes in Microsoft Entra ID. This fulfills the security team's requirement for no cloud password storage.
Why the other options are wrong
- A. Federation with AD FS also meets the requirement, but PTA is a simpler, more cloud-native solution for this specific scenario when only authentication is needed.
- B. Seamless SSO is a feature that provides a single sign-on experience but is not an authentication method itself; it can be used with PHS or PTA.
- D. PHS synchronizes a hash of the user's password to Microsoft Entra ID, which violates the 'no passwords in the cloud' requirement.
Pass-through Authentication (PTA)
Microsoft Entra Pass-through Authentication allows users to sign in to both on-premises and cloud-based applications using the same passwords. It validates users' passwords directly against their on-premises Active Directory.
- No password hashes stored in cloud.
- Requires Lightweight Microsoft Entra Connect Authentication Agents.
- Provides a seamless sign-in experience for users.
Memory trick: PTA: Pass-Through, Passwords Stay At Home