Microsoft 365 FundamentalsDescribe security, compliance, privacy, and trust in Microsoft 365Hard
A company is migrating its on-premises user identities to Microsoft 365. They need to ensure that user passwords and other sensitive identity information are not stored directly in the cloud in a readable format, aligning with the principle of least privilege and data minimization. Which Azure AD authentication method achieves this by maintaining password hashes on-premises while allowing cloud authentication?
- APassword Hash Synchronization (PHS)
- BPass-through Authentication (PTA)
- CFederated Authentication (AD FS)
- DCloud-only identities
Show answer & explanationAnswer & explanation
Correct answer: B. Pass-through Authentication (PTA)
Pass-through Authentication (PTA) allows users to sign in to both on-premises and cloud applications using the same passwords. When users attempt to sign in, PTA agents validate their passwords directly against their on-premises Active Directory, without storing passwords or their hashes in Azure AD, thus adhering to principles of data minimization and not storing sensitive data in the cloud.
Why the other options are wrong
- A. PHS synchronizes a hash of the password hash to Azure AD, meaning a form of the password data is in the cloud.
- C. Federated Authentication (AD FS) offloads authentication to an on-premises AD FS server, but it's a more complex solution than what's needed to simply avoid storing password hashes in the cloud.
- D. Cloud-only identities store passwords directly in Azure AD, which contradicts the requirement.
Azure AD Pass-through Authentication (PTA)
An Azure AD Connect authentication method that allows users to sign in to cloud applications using their on-premises Active Directory passwords, with authentication requests validated directly by on-premises agents.
- No passwords or password hashes are stored in Azure AD.
- Provides a simple way to use on-premises AD for cloud authentication.
- Requires Lightweight PTA agents running on-premises.
Memory trick: Auth with PHS, PTA, or AD FS, choose your cloud door.