Pass-Through Authentication

Pass-Through Authentication (PTA) is a hybrid identity authentication method where password validation happens against on-premises Active Directory, not in Entra ID. PTA agents installed on on-prem servers receive authentication requests from Entra ID, validate against AD, and return results. No password hashes (or hashes-of-hashes) are stored in Entra. Useful for organisations with policy requirements that passwords stay on-prem (some regulatory regimes interpret this strictly). Downside: requires the agents to be online for any user sign-in. Microsoft's recommended approach for hybrid identity is Password Hash Sync for resilience; PTA exists for the cases that genuinely need it.

Worked example

A regulated financial services firm has a policy interpretation that password validation must happen on infrastructure it directly controls, ruling out Password Hash Sync in their reading of the requirement. They deploy PTA agents on at least two on-premises servers for redundancy — Microsoft recommends more than one specifically because a single agent is a single point of failure — and every Microsoft 365 sign-in now round-trips from Entra ID, to an available PTA agent, to on-prem Active Directory, and back, with the password itself never leaving the corporate network in a form Entra ID can read.

Common pitfalls

Deploying only one PTA agent is the most common operational mistake — with just one, any maintenance window or unplanned outage on that single server blocks every sign-in in the tenant, defeating much of the point of choosing PTA over federation in the first place; Microsoft recommends at least two or three for redundancy and load. Choosing PTA "just in case" rather than for a genuine, specific requirement is a second common pattern, since it adds an on-prem availability dependency that Password Hash Sync simply doesn't have, for a compliance nuance that in practice applies to far fewer organisations than believe it does. And underestimating PTA agent maintenance — they need to stay updated and monitored like any other server — leaves organisations surprised when an agent silently falls behind and nobody notices until sign-ins start failing.