Password Hash Sync

Password Hash Sync (PHS) is the Microsoft-recommended hybrid identity authentication method: Entra Connect or Cloud Sync synchronises a hashed-hash (a hash of the password hash) from on-premises Active Directory to Entra ID. Users then authenticate in Entra ID directly, with no on-prem dependency. Resilient to on-prem outages, supports modern features (Identity Protection, PHS-based leaked-credential detection, MFA), and operationally simple. Compared to Pass-Through Authentication (which routes auth to on-prem AD agents) and Federation (which redirects users to AD FS), PHS is the cleanest and most reliable choice for almost all hybrid scenarios.

Worked example

A company migrating off AD FS federation switches to Password Hash Sync as the underlying authentication method. Entra Connect syncs a hash-of-the-hash of each user's on-prem password to Entra ID on a short interval (by default every two minutes for changed passwords), and from that point every sign-in is validated directly in the cloud — no redirect to an on-prem server, no dependency on that server being online. A few weeks later, when the on-prem domain controller goes down overnight for unrelated maintenance, every user can still sign into Microsoft 365 the next morning without noticing anything happened, which is exactly the resilience PHS is chosen for.

Common pitfalls

Assuming PHS means Microsoft "has your passwords" is a common and understandable worry, but incorrect — PHS syncs a one-way hash of a hash, not a reversible password, and Entra ID never receives or stores anything an attacker could use to reconstruct the original password. Believing PHS requires giving up on-prem password policy control is another misconception: paired with Password Hash Sync, Password Writeback and on-prem AD's own policies still govern password complexity and expiry; PHS only changes where authentication happens, not who sets the rules. And forgetting that PHS has a sync delay means a password changed on-prem takes a short time (typically under a couple of minutes) to reach Entra ID — support tickets sometimes come in for "my new password doesn't work yet" in that narrow window, which usually resolves itself within minutes.