Choosing an Azure AD Connect Authentication Method for Microsoft 365 Sync
Decide between Password Hash Sync, Pass-through Authentication, and Federation for Azure AD Connect based on security, infrastructure, and user experience needs.
21 May 2026, 14:24 UTC
Decision and constraints
When synchronizing an on-premises Active Directory with Microsoft 365, you must pick an authentication method for Azure AD Connect. The choice affects security, infrastructure overhead, user experience, and resilience to network or service disruptions. This guide compares the three supported options and walks through a concrete Pass-through Authentication deployment.
Comparison of supported options
| Option | Password Hash Sync (PHS) | Pass-through Authentication (PTA) | Federation (AD FS) |
|---|---|---|---|
| Infrastructure required | None beyond Azure AD Connect | Lightweight agents on-premises (minimum 2 for high availability) | Full AD FS farm with certificates, load balancers, and patching |
| User experience | Seamless SSO possible with the Seamless SSO feature | Seamless SSO with PTA agents | Full SSO via AD FS; integrates with existing Windows Integrated Authentication |
| Security | Password hash stored in Azure AD (encrypted) | No password hash stored; validation occurs against on-premises AD | Full control of authentication policies, MFA, and claim rules |
| Latency | Low (cloud-side hash verification) | Low to moderate (agent round-trip) | Higher (AD FS round-trip) |
| Operational complexity | Low | Medium (agent health monitoring) | High (farm management, certificate renewal) |
Trade-offs
- Password Hash Sync (PHS) is simplest to deploy and keeps working even when on-premises domain controllers are unreachable, because authentication relies on the hash stored in Azure AD. The downside is that the hash persists in the cloud, which may not meet strict data-residency policies.
- Pass-through Authentication (PTA) removes the password hash from Azure AD and validates credentials directly against on-premises AD, letting you enforce on-premises account policies. It requires at least two healthy agents for redundancy; if all agents fail, users cannot sign in.
- Federation (AD FS) gives complete control over the authentication flow, including custom MFA providers and complex claim transformations. That control comes with higher cost, more moving parts, and ongoing certificate and federation metadata maintenance.
Implementing Pass-through Authentication
The steps below deploy PTA with Seamless SSO. Adjust server names and account details to match your environment. This was written against Azure AD Connect version 1.1.819.0 or later, which is the minimum that includes the PTA agent; confirm the current supported version before deploying.
- Prerequisites
- Global Administrator (or Hybrid Identity Administrator) role in Azure AD.
- Domain-joined Windows Server machines to host the PTA agents.
- Network connectivity from the agent servers to your domain controllers (LDAP and Kerberos ports) and outbound HTTPS to Azure AD.
- Run the Azure AD Connect wizard
Install Azure AD Connect on the server that hosts the sync engine. On the User sign-in page, select
Pass-through Authentication. The wizard enables Seamless SSO automatically if the forest is eligible. - Deploy PTA agents
After the sync engine installation completes, install the PTA agent on at least two domain-joined servers for redundancy. During agent setup, sign in with an admin account and register each agent with your Azure AD tenant.
- Confirm Seamless SSO
If Seamless SSO was not enabled automatically, enable it from the Azure AD Connect wizard (Change user sign-in page) or via PowerShell on a domain-joined machine. This creates the Kerberos computer account (
AZUREADSSOACC) whose decryption key must be shared with Azure AD so devices can acquire tokens silently. - Verify synchronization
In the Synchronization Service Manager, confirm the sync cycle completes without errors and that the tenant shows Pass-through Authentication as the sign-in mode in the Azure portal under Azure AD Connect.
Verification
- Sign in with a test user from a domain-joined device to a cloud app such as Outlook on the web.
- In the Azure portal, go to Azure Active Directory > Sign-in logs, filter for the test user, and check the authentication details; the method should show PTA (with Seamless SSO noted if enabled).
- To confirm Seamless SSO, access the app without a credential prompt and verify a silent token acquisition appears in the sign-in logs.
Limitations and practical checks
- Agent health: if all PTA agents become unreachable, authentication fails. Monitor agents through the Azure AD Connect Health portal and keep agent software up to date.
- Network latency: PTA adds a round-trip to the on-premises agents; measure latency from agent servers to domain controllers during peak hours.
- Offline scenarios: PTA does not work when agents cannot reach AD, such as during a WAN outage. Many organizations enable PHS alongside PTA as a fallback for emergency access.
- Seamless SSO on Azure AD-joined devices: verify the Kerberos decryption share is in place, or users may see a double prompt during sign-in.
microsoft-3650 replies
A thoughtful contribution can make all the difference. Be the first to share one.