PHS, PTA or federation: choosing your hybrid authentication method
In a hybrid environment, users sign in to Microsoft 365 with their Active Directory password. But who checks that password, and where? The answer depends on the method in place, and that choice, often inherited from an old project, has a direct impact on the attack surface and on service continuity.
Three ways to validate a password
Microsoft Entra ID offers three methods for accounts synchronised from Active Directory:
- Password hash synchronization (PHS): Entra ID checks the password itself, using a derivative of the synchronised hash;
- Pass-through authentication (PTA): Entra ID forwards the request to agents installed on premises, which validate it against the domain controllers;
- Federation, usually with AD FS: authentication is fully delegated to an on-premises identity provider, which issues a token that Entra ID accepts.
Password hash synchronization
Contrary to a common belief, PHS does not send the NT hash as is: Entra Connect computes a salted, iterated derivative of it, and only that is transmitted. The method does not rely on any on-premises infrastructure at sign-in time: if the datacentre is down or encrypted by ransomware, users can still reach cloud services.
PHS is also a prerequisite for leaked credentials detection in Microsoft Entra ID Protection, which compares credentials found in public leaks with those in the tenant. Its limitations are well known: disabling an account or expiring a password in Active Directory is not reflected instantly, and the expiration policy is not enforced in the cloud without specific configuration.
Pass-through authentication
With PTA, the password is never stored in the cloud in any form, and Active Directory policies (lockout, logon hours, disabled accounts) apply immediately. The agents only open outbound connections.
In return, sign-in depends on the availability of the agents and domain controllers: Microsoft recommends several agents for high availability. Above all, a server running a PTA agent sees passwords in clear text and can be tampered with to accept any password. It therefore belongs to Tier 0, just like a domain controller.
Federation
Federation offers the most flexibility: smart card authentication, third-party MFA, complex claims rules. It is also the most expensive to maintain and the most exposed: servers are published to the internet through proxies, and theft of the token-signing certificate allows tokens to be forged for any user, bypassing MFA. This attack, known as Golden SAML, has been used in major compromises.
Comparison
| Criterion | PHS | PTA | Federation |
|---|---|---|---|
| On-premises dependency at sign-in | None | Agents and domain controllers | Full federation infrastructure |
| Leaked credentials detection | Yes | Only if PHS is also enabled | Only if PHS is also enabled |
| Immediate enforcement of AD policies | No | Yes | Yes |
| Additional Tier 0 components | Sync server | Agent servers | Federation servers and proxies |
Enable PHS regardless. Even if you keep PTA or federation, enabling password hash synchronization alongside it gives you leaked credentials detection and a fallback in case of an on-premises outage or incident.
Our recommendation
For the vast majority of organisations, PHS offers the best balance of security, resilience and simplicity, and it is the method Microsoft recommends. PTA makes sense when a regulatory requirement forbids any password derivative in the cloud. Federation should only remain for specific needs, and keeping it must come with stronger protection of its servers and certificates.
What an audit checks
- The effective authentication method of each domain in the tenant.
- Whether PHS is enabled, including as a fallback.
- The number, location and protection level of PTA agents.
- For federation, management of the token-signing certificate and server exposure.
- How disabled accounts and expired passwords are handled on the cloud side.