Hybrid Identity
Password hash sync · Pass-through auth · Federation · Cloud Sync
Practice questions for this topic →
Sign-in methods
| Method | Where password is validated | Pick when… |
|---|---|---|
| Password hash sync (PHS) | Entra ID (cloud); sync runs every 2 minutes (fixed) | Simplest; keeps working if on-prem is down; enables leaked-credential detection; synced hash overwrites the cloud password |
| Pass-through authentication (PTA) | On-prem AD through lightweight outbound-only agents (no DMZ needed) | Must enforce on-prem password and account policies at sign-in; no passwords in the cloud |
| Federation (AD FS / third-party) | On-prem identity provider | Smart cards or certificates on-prem, third-party MFA, requirements Entra can't meet natively |
- The sign-in method is independent of the sync technology: Connect Sync or Cloud Sync don't change how sign-in works.
- Changing the method takes planning, testing and possibly downtime. Staged Rollout tests cloud authentication with selected groups before you convert the domain.
Entra Connect Sync vs Entra Cloud Sync (Microsoft's scenario comparison)
| Scenario | Entra Connect Sync | Entra Cloud Sync |
|---|---|---|
| Architecture | On-premises sync server with its own engine and database; configuration managed on the server | Lightweight provisioning agents; configuration stored in the cloud; syncs about every 2 minutes using SCIM |
| High availability | Single sync server: if it's unavailable, sync stops until restored | Multiple active agents with automatic failover |
| Mergers and acquisitions (disconnected forests) | Not applicable | ✓ |
| Group provisioning to Active Directory | Not applicable | ✓ |
| Sync large domains (more than 250K objects) | ✓ | Not applicable |
| User accounts in one forest, mailboxes in a resource forest | ✓ | Not applicable |
| Filter directory objects by attribute values | ✓ | Not applicable |
| Windows Hello for Business | ✓ | Not applicable |
| New hybrid customers; hybrid join; Exchange hybrid; migration from Connect to Cloud Sync | ✓ | ✓ |
| Microsoft's direction | Keep for scenarios only it supports | Strategic direction; evaluate it first for new deployments |
- Cloud Sync syncs users, groups and contacts; with device sync enabled it also syncs computer objects so devices can become Microsoft Entra hybrid joined. Its agent uses the same technology as App Proxy and PTA: outbound-only, automatic updates.
- Cloud Sync flow (Microsoft Learn): 1. agent communication (a persistent outbound connection through Azure Service Bus) → 2. request processing (the agent receives SCIM requests and queries Active Directory) → 3. data filtering and transformation (scoping rules and attribute mappings) → 4. cloud processing (the provisioning service commits changes to Entra ID, tracking state with watermarks).
- You can run Cloud Sync and Connect Sync in the same forest, with mutually exclusive scoping filters (or no clashing attribute values, since precedence isn't supported).
- Connect V1 retired Aug 31, 2022; upgrade to Connect V2 or move to Cloud Sync, which Microsoft recommends because new features are developed there first.
Exam Tips
Tick each tip once you can answer it without looking.
“Simplest hybrid sign-in with least on-prem infrastructure” → Password hash sync.
“Users must still be able to sign in to Microsoft 365 if the on-prem datacenter is down” → Password hash sync. Trap: PTA and federation depend on on-prem.
“Enforce on-prem logon hours and account states at cloud sign-in; no password hashes in cloud” → Pass-through authentication.
“Leaked credential detection (Identity Protection)” → Requires password hash sync.
“Sync users from several disconnected AD forests after an acquisition, minimal infrastructure” → Entra Cloud Sync. Trap: Connect Sync isn't listed as supporting disconnected forests.
“High availability for the sync engine” → Cloud Sync: multiple active agents with automatic failover. Connect Sync: a single sync server, so sync stops if it's unavailable.
“Users on domain-joined PCs shouldn't type their password for cloud apps” → Seamless SSO / Microsoft Entra hybrid join.
“Users reset their password in the cloud and it applies on-prem” → SSPR + password writeback (P1).
“Apps in Azure VMs need Kerberos/LDAP/NTLM without deploying domain controllers” → Microsoft Entra Domain Services.
“Does Connect Sync or Cloud Sync change how sign-in works” → No: the sign-in method is independent of the sync technology. Trap: Changing method needs planning and testing; Staged Rollout pilots it.
“Cloud Sync agent facts” → Lightweight outbound-only agents, automatic updates, cloud-held configuration, SCIM, about every 2 minutes. Trap: With device sync it can make devices hybrid joined.
“Where PTA agents go” → Inside the network making outbound connections only; no DMZ. Trap: Passwords are never stored in the cloud.
“Entra Connect V1 status” → Retired August 31, 2022: upgrade to Connect V2 or move to Cloud Sync. Trap: Microsoft recommends Cloud Sync; new features land there first.
“Run Cloud Sync and Connect Sync together” → Allowed in the same forest if scoping filters are mutually exclusive or attribute values don't clash. Trap: Precedence isn't supported.
“Order of the Cloud Sync synchronization flow” → Agent communication, request processing, data filtering and transformation, cloud processing. Trap: The agent only makes outbound connections and sync runs about every two minutes.