Password Hash Sync vs. Pass-Through Authentication

Password hash sync lets Microsoft 365 validate a hybrid user's password in the cloud. Pass-through authentication checks that password against the company's on-premises Active Directory during sign-in.

For most businesses, the choice comes down to where password validation happens and what should happen if the office network goes down. Both methods can give employees one work password, but they have different availability and support requirements.

The difference between PHS and PTA

Microsoft 365 uses Microsoft Entra ID to manage cloud identities. If your business also uses on-premises Active Directory, you can synchronize user accounts and choose how Entra ID validates their passwords.

Password Hash Synchronization (PHS) sends a derived password hash to Entra ID. Pass-through Authentication (PTA) sends password validation requests to on-premises agents, which check them against Active Directory.

The practical distinction is availability: PHS doesn't need your office network for every cloud password sign-in , while PTA does.

How password hash sync works

With PHS, Microsoft Entra Connect Sync synchronizes a derived representation of each user's on-premises password hash to Entra ID. Microsoft 365 doesn't receive or store the user's clear-text Active Directory password through this synchronization process.

What happens during synchronization

Microsoft Entra Connect Sync retrieves the on-premises password hash and applies additional processing before sending a derived hash to Entra ID over an encrypted connection. The cloud value isn't a copy of the original Active Directory password hash.

Microsoft documents a two-minute synchronization interval for password hashes. That interval isn't a guarantee that a changed password will work in Microsoft 365 exactly two minutes later. Replication, connectivity, and service health can affect the time it takes.

What happens during sign-in

When an employee signs in with a password, Entra ID validates it against the synchronized cloud value. A domain controller doesn't need to respond to that individual Microsoft 365 sign-in.

Synchronization still matters. If it stops, password changes and other directory updates can be delayed. Staff who haven't changed their passwords may continue signing in, but the cloud directory can fall behind on changes made on-premises.

How pass-through authentication works

PTA keeps password validation in on-premises Active Directory. Users still sign in through Microsoft Entra ID, but an authentication agent checks their password against a domain controller.

What the authentication agent does

A PTA agent runs on a server with access to Active Directory Domain Services and an outbound connection to Microsoft's cloud service. When a user submits a password, the agent receives the validation request and asks Active Directory to check the credentials.

The agent communicates through outbound connections. However, it still depends on working network access to a domain controller and Microsoft Entra ID. Installing an agent doesn't remove the need to maintain the underlying servers and connectivity.

How Active Directory affects access

Because Active Directory validates the password, PTA can apply on-premises account restrictions during password sign-in. That can matter when a business has requirements tied to account status or on-premises sign-in policies.

PTA does not eliminate cloud dependencies. Entra ID remains part of the sign-in path, and Microsoft 365 still needs its cloud services to be available. Existing sessions can also behave differently from a fresh password sign-in.

What happens during an outage or password change

The difference becomes clear when a server fails or a user resets a password. The following scenarios assume Microsoft Entra ID and the relevant Microsoft 365 service are available.

If the office network goes down

With PHS, employees can generally continue new cloud password sign-ins using the last password hash that reached Entra ID. A disconnected domain controller doesn't have to approve each request.

With PTA, new password sign-ins can fail if no authentication agent can reach both Microsoft Entra ID and Active Directory. Several agents reduce the risk of a single server failure, but they can't fix a shared internet outage or an unavailable domain controller.

An employee with an existing session may continue working for a time under either method. That isn't a reliable outage plan, because apps and policies can require a new sign-in.

If someone changes a password or leaves

With PHS, a new on-premises password must synchronize before it's accepted for cloud password sign-in. If synchronization is delayed, the previous password can remain usable in the cloud until the update arrives.

With PTA, Active Directory validates the password at sign-in, so the new password is used through the on-premises validation path. Offboarding still needs more than a password change: block access, remove permissions, and address active sessions as part of the departure process.

Security considerations for both methods

Neither method replaces multifactor authentication. A stolen or reused password can give an attacker a route into Microsoft 365 unless other controls stop the sign-in.

Password storage and authentication risk

PHS places a derived password hash in Entra ID. That can be a concern for a business whose internal policy prohibits storing any password-derived value in the cloud. The organization should choose a method that meets its documented requirements, rather than assume every security policy treats hashes the same way.

PTA keeps password validation on-premises, but its agents and servers become important security assets. A compromised server or poorly controlled administrator account can expose the sign-in environment. Protect and update those systems, and restrict who can manage them.

MFA and Conditional Access

Require MFA for users and administrators regardless of the password validation method. Where possible, use phishing-resistant methods, such as supported passkeys or security keys, for sensitive roles.

Conditional Access can add requirements based on factors such as device compliance or the application being accessed. It requires appropriate licensing, including Microsoft Entra ID P1 for Conditional Access. Our comparison of Entra ID P1 and P2 explains how those plans differ.

Keep separate administrative accounts and review sign-in activity. Also maintain protected cloud-only emergency access accounts so an on-premises outage doesn't leave administrators without a recovery route.

Servers, monitoring, and recovery requirements

PHS generally has fewer systems in the path of each cloud sign-in. PTA requires more attention to agent health, domain controllers, and network connectivity.

Planning for PHS synchronization

Monitor the synchronization server and investigate failures promptly. A business may not notice a problem while existing passwords continue to work, so monitoring should alert IT before a password change or account update exposes the issue.

Microsoft recommends a second Entra Connect server in staging mode for synchronization continuity. It can take over if the active synchronization server fails, but it isn't a substitute for documenting and testing the recovery process.

Building redundancy for PTA

Microsoft recommends three PTA agents: one on the Entra Connect server and two additional agents. Place them on supported servers with reliable access to domain controllers and outbound internet connectivity.

Multiple agents help when an individual agent or server fails. They don't guarantee uninterrupted access if all agents depend on the same failed network or directory service. Monitor agent availability and assign someone to respond when an agent goes offline.

A staging server for directory synchronization and extra PTA agents address different risks. Businesses using PTA should plan for both synchronization recovery and authentication-agent availability.

What employees experience

Both methods let a synchronized user work with the same password for on-premises Active Directory and Microsoft 365. The sign-in screen alone usually won't tell an employee which validation method the business uses.

A shared password doesn't automatically mean employees will never see a prompt. Their experience also depends on device setup, app sessions, MFA, and sign-in policies. A user may need to authenticate again after a policy change or when a session expires.

Single sign-on is a related but separate choice. It can reduce repeated prompts in supported setups, while PHS or PTA determines how password validation happens. Neither should be confused with account provisioning, which controls how identities and access are created or removed.

Before changing methods, tell staff when the change will happen and how to reach support. Test a normal sign-in, a password change, and an MFA prompt with a small group. That gives IT a chance to catch unexpected app or device issues before the change affects the whole company.

Choosing PHS, PTA, or a hybrid recovery plan

For many small and midsize businesses, PHS is the practical starting point. It supports cloud sign-ins without relying on an office server for every password check, which can reduce disruption during a local outage.

PTA fits a business that needs on-premises Active Directory to validate passwords at sign-in and can support the required infrastructure. Its availability depends on more than one healthy server, so the support plan should include monitoring, redundancy, and a response process.

When both can make sense

A business can use PTA as its active sign-in method while synchronizing password hashes as a backup. This can give administrators a recovery option if the on-premises authentication path becomes unavailable.

The important limitation is that PTA doesn't automatically fail over to PHS . An administrator must switch the sign-in method using Microsoft Entra Connect. The backup also depends on password hashes having been synchronized before they're needed.

Make the decision operational

Document who can make the switch, how that person accesses an administrative account during an outage, and how employees will receive updates. Test the procedure as a planned change rather than treating synchronized hashes alone as a complete recovery plan.

Also review your requirements for account restrictions, MFA, and licensing. A method that matches policy but has no one available to maintain it can create an avoidable interruption.

Choose a sign-in method your team can support

PHS favors cloud sign-in availability. PTA keeps password validation on-premises but adds infrastructure to the sign-in path. Both need security controls, monitoring, and a clear recovery process.

If you want help deciding which setup fits your business, we can help align Microsoft 365 support with your network and continuity needs.