3.4.2. Hybrid Authentication: PHS, PTA, and Seamless SSO
💡 First Principle: After sync decides who exists, authentication method decides who checks the password — Microsoft's cloud (PHS), your domain controllers via agents (PTA), or your federation farm (AD FS). Each step toward on-prem control adds infrastructure and failure modes; each step toward cloud adds resilience but delegates verification. Choose by requirement, not preference.
| Password hash sync (PHS) | Pass-through auth (PTA) | Federation (AD FS) | |
|---|---|---|---|
| Password verified by | Entra ID (against synced hash-of-hash) | Your DCs via outbound agents | Your AD FS farm |
| On-prem footprint | None beyond sync | 2–3 lightweight agents | Servers + proxies + certs |
| Works if on-prem is down | ✅ Sign-in unaffected | ❌ No validation possible | ❌ Farm down = sign-in down |
| Instant on-prem policy (disable, hours, expiry) | Lag (sync interval) | ✅ Immediate | ✅ Immediate |
| Certificate/smart-card & third-party MFA on-prem | ❌ | ❌ | ✅ |
| Leaked-credential detection benefit | ✅ (hash comparison) | Recommended: enable PHS alongside | With PHS alongside |
| Microsoft recommendation | Default choice | When immediate on-prem validation is mandated | Only for hard requirements |
Mechanics worth one line each: PHS re-hashes the AD hash (SHA256 over MD4 + salt + iterations) — the cloud can't derive the password; PTA agents hold no passwords and connect outbound only (deploy ≥2, ideally 3 for HA); Seamless SSO complements either — a computer account (AZUREADSSOACC) in AD lets domain-joined machines on the corporate network get silently signed in via Kerberos (roll its key regularly). Staged rollout moves pilot groups from federation to PHS/PTA per-group before flipping the domain.
The resilience argument decides many stems: PHS is the only method where an on-prem outage (or ransomware event) leaves cloud sign-in working — which is also why Microsoft recommends enabling PHS as backup even when PTA/federation is primary.
⚠️ Exam Trap: "Password expired / account disabled on-prem must be enforced immediately at cloud sign-in" → PTA (or federation), because PHS honors such states only after sync's lag. Conversely "sign-in must survive on-prem outage" → PHS. The two requirements are opposites; stems pick one.
Reflection Question: Security wants leaked-credential detection and the ability to sign in during an on-prem outage; compliance insists password validation happen on-prem in normal operation. What combination satisfies all three, and what's the trade at failover time?
