PHS, PTA or federation: choosing hybrid authentication and moving off AD FS
In a hybrid environment, the way Entra ID verifies passwords is not an architectural detail: it shapes service resilience, the on-premises attack surface and some detection capabilities. Many organisations keep AD FS out of habit, even though the reasons that once justified it have often gone.
The three methods
- Password hash synchronisation (PHS): Entra Connect synchronises a derivative of the Active Directory password hash. Entra ID verifies passwords itself, with no dependency on on-premises infrastructure.
- Pass-through authentication (PTA): Entra ID hands verification to agents installed on premises, which validate it against domain controllers.
- Federation (usually AD FS): authentication is fully delegated to the on-premises identity provider, which issues signed tokens that Entra ID accepts.
Comparing on concrete criteria
Resilience. With PHS, an outage at the main site or a ransomware attack on Active Directory does not stop users signing in to cloud services. With PTA or federation, unavailable agents or AD FS servers block sign-ins.
Attack surface. AD FS servers and PTA agents are Tier 0 assets: an attacker who controls AD FS and its signing key can forge tokens for any federated user, MFA included, without leaving an authentication trace in Entra ID. PHS does not reduce the importance of the Entra Connect server, but it does not add that kind of exposed component.
Detection. Leaked credentials detection in Entra ID Protection requires PHS. Smart lockout and sign-in risk detection work fully when authentication takes place in Entra ID.
Genuine federation constraints. Federation is still needed in a few cases: a strict regulatory requirement not to synchronise hashes, or very specific authentication scenarios. Most historical needs (smart cards, MFA, sign-in hour restrictions) now have a native equivalent in Entra ID.
Our audit position. Unless there is a documented constraint, PHS is the default choice. Even where PTA or federation stays in place, enabling PHS alongside provides a fallback and turns on leaked credentials detection.
Preparing to leave AD FS
The work starts with an inventory, not with the cut-over:
- list every AD FS relying party trust: Microsoft 365 is often not the only application, and the AD FS application activity report in Entra ID helps assess their migration;
- analyse claim rules and authorisation rules to identify what will need to be reproduced in Conditional Access;
- check how MFA is performed today (on AD FS or in Entra ID) and prepare to move it into Entra ID;
- check hybrid device join, which may depend on AD FS in older configurations;
- enable PHS and confirm that hash synchronisation is complete.
Moving gradually with staged rollout
Staged rollout lets you move groups of users to cloud authentication, PHS or PTA, while the domain remains federated. You start with a pilot group, monitor sign-ins, deal with issues, then widen in waves. The feature has limits (supported group types, number of groups, some scenarios not covered): check them in the current documentation.
Once every user has been validated, the domain is converted from federated to managed, through the Entra Connect wizard or Microsoft Graph PowerShell. Remaining applications then need to be migrated to Entra ID, and only after that should AD FS be decommissioned: remove the trust with Entra ID, shut the servers down, archive the logs and retire the signing certificates.
Points to watch after the cut-over
With PHS, some on-premises account states are not reflected instantly: a disabled account is picked up at the next synchronisation cycle, and Active Directory password expiry is not enforced in the cloud by default. These behaviours must be understood and, where needed, offset by suitable settings or procedures, particularly for urgent leavers.
What an audit checks
- The authentication method in place for each domain and the justification for any federation.
- Whether PHS is enabled, including as a fallback.
- Hardening of AD FS servers or PTA agents, treated as Tier 0 assets.
- The inventory of applications still dependent on AD FS.
- How disabled accounts and expired passwords behave in the cloud.
- The urgent leaver procedure, including revocation of cloud sessions.