Sign-in option in Microsoft Entra Connect that copies password hashes to the cloud, so Microsoft Entra ID itself handles authentication and lockout.
Also called PHS.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Password hash sync in context, with comparison tables and the common traps.
Terms in this definition
- Microsoft Entra Connect
Keeps Microsoft Entra ID in step with an on-premises Active Directory by synchronising its identities to the cloud.
- Microsoft Entra ID
Cloud identity service from Microsoft, previously named Azure AD, which provides the tenant behind Microsoft 365 and Azure.
- Authentication
Checking an identity claim made by a person, device or app, for instance by asking for a password plus an extra factor. Authorisation only happens once this step has succeeded.
Related terms
- Hybrid Identity Administrator
The Entra role for managing federation, PHS, PTA, cloud sync and Entra Connect settings. It is the cloud role with the least privilege that still covers Entra Connect.
- Seamless single sign-on
A Microsoft Entra capability, included at no extra cost, that signs people in without a password prompt when they use domain-joined company devices on the company network. It pairs with password hash sync or pass-through authentication; AD FS is not supported.
- Seamless SSO
Entra feature that silently signs in domain-joined devices on the corporate network when using pass-through authentication or password hash sync, though not AD FS. No inbound ports are needed, but autologon.microsoftazuread-sso.com must be in the Local intranet zone.
- Smart lockout
Locks out brute-force attempts against Microsoft Entra ID and comes with all editions. On-premises accounts are left unlocked where password hash sync is in place.
- Staged rollout
Before converting federated domains to managed, you can temporarily move chosen groups over to pass-through, certificate-based or password hash sync sign-in to try it out.
- Staging mode
A standby setting for a Microsoft Entra Connect Sync server: imports and synchronisation still happen, yet nothing is exported, and writeback and password hash sync are skipped. Handy for failover or for previewing configuration changes.