Domain 1 of 4 · Chapter 4 of 4

Hybrid Identity

Unlock the complete study guide + 1,040 practice questions across 16 full exams.

Bundled into the existing Microsoft Certified: Identity and Access Administrator Associate premium course — no separate purchase.

Included in this chapter:

  • Sync vs sign-in: the two hybrid decisions
  • Connect Sync vs Cloud Sync: choosing the provisioning tool
  • Cloud authentication: PHS, PTA, and seamless SSO
  • Migrating from AD FS and Connect Health

Hybrid sign-in methods: where the password is checked

DimensionPassword hash sync (PHS)Pass-through auth (PTA)Federation (AD FS)
Where credentials are validatedIn the cloud (Entra ID)On-premises by the agent against AD (never in the cloud)On-premises by AD FS
Extra on-prem servers neededNone (beyond the sync server)Lightweight agents (3 recommended, 12 max)2+ AD FS servers and 2+ WAP servers
Network direction requiredNoneOutbound from agents (no perimeter network)Inbound to WAP servers
Enforces on-prem account state instantlyNo (disabled accounts up to 30-min delay)Yes (disabled, locked, expired, sign-in hours)Yes
Health monitoringNot requiredAgent status in Entra admin centerConnect Health for AD FS
Microsoft recommendationRecommended default; also use as backupWhen real-time on-prem policy is requiredOnly for native gaps (e.g. third-party MFA via IdP)

Decision tree

Need device sync, device writeback,or over 150,000 objects?YesNoUse Connect Syncfull-featured sync serverUse Cloud Synclightweight cloud-managedNative gap, e.g. 3rd-party MFAvia a federated provider?YesNoKeep federation (AD FS)most complex; last resortEnforce on-prem account stateinstantly at each sign-in?YesNoPass-through auth (PTA)3 agents; outbound-onlyPassword hash syncsimplest; recommendedAlways: enable password hash sync as backup
Cheat sheet

Cheat sheet

  • Sync choice and sign-in choice are independent decisions
  • Password hash sync syncs a hash of a hash, never the plaintext password
  • Enable password hash sync as the backup even when it is not your primary method
  • PHS does not enforce on-premises account changes instantly
  • Pass-through authentication validates passwords on-premises with outbound-only agents
  • Deploy three PTA agents for high availability; a tenant supports 12 max
  • Seamless SSO rides on PHS or PTA; it is not a separate authentication method
  • Seamless SSO uses the AZUREADSSO account; roll its Kerberos key every 30 days
  • Federation (AD FS) validates passwords on-premises and is the last-resort method
  • Cloud Sync is the lightweight, cloud-managed sync; choose it by default
  • Cloud Sync caps at 150,000 objects per AD domain
  • Cloud Sync supports groups up to 50,000 members; Connect Sync up to 250,000
  • Device sync and Hybrid Azure AD Join require Connect Sync, not Cloud Sync
  • Both sync tools run a sync cycle every two minutes
  • Use staged rollout to pilot cloud auth before converting domains
  • Staged rollout does not support nested or dynamic membership groups
  • Convert domains from federated to managed with Update-MgDomain
  • Domain conversion to managed can take up to 60 minutes
  • Connect Health monitors AD FS; PHS needs no health monitoring
  • PTA agents and Cloud Sync agents both rely on outbound connections over Azure Service Bus
  • Keeping AD FS for SAML/WS-Fed apps does not block converting domains to managed
  • Group scoping in Cloud Sync and cross-tenant sync includes only direct members
  • The Seamless SSO autologon URL must be in the Local intranet zone for Kerberos to flow
  • Override sync attribute flow with a higher-precedence custom rule, never by editing out-of-box rules
  • The provisioning agent needs a domain-joined Windows Server 2016/2019/2022 (not Server Core)

Unlock with Premium — includes all practice exams and the complete study guide.

References

  1. Choose the right authentication method for hybrid identity
  2. What is Microsoft Entra Cloud Sync
  3. Connect-to-Cloud-Sync decision guide (Connect Sync vs Cloud Sync comparison)
  4. Implement password hash synchronization
  5. User sign-in with pass-through authentication
  6. Migrate from federation to cloud authentication
  7. Microsoft Entra seamless single sign-on
  8. Migrate to cloud authentication using staged rollout
  9. Monitor AD FS using Microsoft Entra Connect Health