Domain 1 of 4 · Chapter 4 of 4

Hybrid Identity

Unlock the complete study guide + 1,040 practice questions across 16 full exams.

Bundled into the existing Microsoft Certified: Identity and Access Administrator Associate premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • Sync vs sign-in: the two hybrid decisions
  • Connect Sync vs Cloud Sync: choosing the provisioning tool
  • Cloud authentication: PHS, PTA, and seamless SSO
  • Migrating from AD FS and Connect Health

Hybrid sign-in methods: where the password is checked

DimensionPassword hash sync (PHS)Pass-through auth (PTA)Federation (AD FS)
Where credentials are validatedIn the cloud (Entra ID)On-premises by the agent against AD (never in the cloud)On-premises by AD FS
Extra on-prem servers neededNone (beyond the sync server)Lightweight agents (3 recommended, 12 max)2+ AD FS servers and 2+ WAP servers
Network direction requiredNoneOutbound from agents (no perimeter network)Inbound to WAP servers
Enforces on-prem account state instantlyNo (disabled accounts up to 30-min delay)Yes (disabled, locked, expired, sign-in hours)Yes
Health monitoringNot requiredAgent status in Entra admin centerConnect Health for AD FS
Microsoft recommendationRecommended default; also use as backupWhen real-time on-prem policy is requiredOnly for native gaps (e.g. third-party MFA via IdP)

Decision tree

Need device sync, device writeback,or over 150,000 objects?YesNoUse Connect Syncfull-featured sync serverUse Cloud Synclightweight cloud-managedNative gap, e.g. 3rd-party MFAvia a federated provider?YesNoKeep federation (AD FS)most complex; last resortEnforce on-prem account stateinstantly at each sign-in?YesNoPass-through auth (PTA)3 agents; outbound-onlyPassword hash syncsimplest; recommendedAlways: enable password hash sync as backup
Cheat sheet

Cheat sheet

  • Sync choice and sign-in choice are independent decisions
  • Password hash sync syncs a hash of a hash, never the plaintext password
  • Enable password hash sync as the backup even when it is not your primary method
  • PHS does not enforce on-premises account changes instantly
  • Pass-through authentication validates passwords on-premises with outbound-only agents
  • Deploy three PTA agents for high availability; a tenant supports 12 max
  • Seamless SSO rides on PHS or PTA; it is not a separate authentication method
  • Seamless SSO uses the AZUREADSSO account; roll its Kerberos key every 30 days
  • Federation (AD FS) validates passwords on-premises and is the last-resort method
  • Cloud Sync is the lightweight, cloud-managed sync; choose it by default
  • Cloud Sync caps at 150,000 objects per AD domain
  • Cloud Sync supports groups up to 50,000 members; Connect Sync up to 250,000
  • Device sync and Hybrid Azure AD Join require Connect Sync, not Cloud Sync
  • Both sync tools run a sync cycle every two minutes
  • Use staged rollout to pilot cloud auth before converting domains
  • Staged rollout does not support nested or dynamic membership groups
  • Convert domains from federated to managed with Update-MgDomain
  • Domain conversion to managed can take up to 60 minutes
  • Connect Health monitors AD FS; PHS needs no health monitoring
  • PTA agents and Cloud Sync agents both rely on outbound connections over Azure Service Bus
  • Keeping AD FS for SAML/WS-Fed apps does not block converting domains to managed
  • Group scoping in Cloud Sync and cross-tenant sync includes only direct members
  • The Seamless SSO autologon URL must be in the Local intranet zone for Kerberos to flow
  • Override sync attribute flow with a higher-precedence custom rule, never by editing out-of-box rules
  • The provisioning agent needs a domain-joined Windows Server 2016/2019/2022 (not Server Core)

Unlock with Premium — includes all practice exams and the complete study guide.

Also tested in

References

  1. Choose the right authentication method for hybrid identity
  2. What is Microsoft Entra Cloud Sync
  3. Connect-to-Cloud-Sync decision guide (Connect Sync vs Cloud Sync comparison)
  4. Implement password hash synchronization
  5. User sign-in with pass-through authentication
  6. Migrate from federation to cloud authentication
  7. Microsoft Entra seamless single sign-on
  8. Migrate to cloud authentication using staged rollout
  9. Monitor AD FS using Microsoft Entra Connect Health