1. Understanding Password Hash Synchronization
Password Hash Synchronization (PHS) is one of the core sign-in methods available in Microsoft Entra Connect for hybrid identity.
Its main goal is to ensure users can use the same password for both on-premises Active Directory (AD DS) and Microsoft Entra ID (Azure AD) — without requiring any federation or additional authentication servers.
Key idea: Microsoft Entra Connect periodically synchronizes a hash of the hash of each user’s password from AD DS to Entra ID. This means the actual password never leaves the on-premises environment — even Microsoft cannot decrypt or view it.
When a user signs into a cloud service (like Microsoft 365, SharePoint, or Teams), Entra ID uses the stored password hash to authenticate the user.
2. How Password Hash Synchronization Works (Step-by-Step)
Let’s break down the process carefully to understand what happens behind the scenes.
This process ensures that passwords are never stored or transmitted in clear text and that Microsoft only ever stores non-reversible hashes.
3. Frequency and Synchronization Behavior
When you first enable password hash synchronization:
You cannot manually select which passwords to sync in the initial run.
4. How PHS Enhances Security
Microsoft designed PHS with layered security in mind:
| Security Layer | Explanation |
|---|---|
| One-way hashing | AD already stores passwords as hashes (using MD4). PHS takes that hash and re-hashes it with SHA256, adding cryptographic salt. |
| No plain text passwords | Neither the original password nor the first hash is ever exposed. |
| Transport layer encryption | Synchronization traffic between the Entra Connect server and Microsoft Entra ID is encrypted with TLS. |
| Immutable audit trail | Logs are recorded for every synchronization event for traceability. |
| Global redundancy | Because authentication happens in the Microsoft cloud, users can still sign in even if on-prem AD is offline. |
5. Enabling Password Hash Synchronization
Scenario 1: During Installation (Express Mode)
If you choose Express Settings when installing Microsoft Entra Connect:
Scenario 2: During Custom Installation
If you select Custom Settings, you’ll see a screen titled “User Sign-In Options” where you can choose from:
To enable PHS manually:
6. PHS and FIPS Compliance
Some organizations operate under FIPS (Federal Information Processing Standard) mode, which disables MD5 cryptographic functions for compliance. However, PHS internally relies on MD5 as part of its hashing pipeline.
To support PHS on FIPS-enforced servers, you must explicitly re-enable MD5 for this purpose only.
Steps:
Open the file:
%ProgramFiles%\Azure AD Sync\Bin\miiserver.exe.config
Locate the <configuration> section and add:
<runtime>
<enforceFIPSPolicy enabled="false"/>
</runtime>
Save the file and restart the synchronization service.
This setting allows the PHS mechanism to function while the rest of your system remains FIPS-compliant.
7. Password Hash Synchronization with PingFederate
Although PHS is most often used standalone, it can also coexist with PingFederate for organizations using federated sign-in.
Use case example:
Steps:
This setup provides resiliency — even if PingFederate or the on-prem network fails, users can temporarily authenticate via PHS.
8. Business Continuity and High Availability
This makes PHS an excellent business continuity strategy, especially when compared to federation or PTA, which both rely on local infrastructure.
9. Troubleshooting and Monitoring PHS
Tools available:
Common issues:
| Issue | Cause | Fix |
|---|---|---|
| Password not syncing | User’s password recently changed and sync hasn’t run | Wait 2 minutes or manually trigger sync via PowerShell (Start-ADSyncSyncCycle -PolicyType Delta) |
| PHS not working after reinstall | FIPS mode blocking MD5 | Disable FIPS enforcement as shown earlier |
| Partial sync failures | Corrupt user object or permissions issue | Check synchronization rules and service account permissions in AD |
10. Advantages and Limitations Summary
| Aspect | Advantages | Limitations |
|---|---|---|
| Setup | Quick and simple; minimal configuration | Can’t be filtered for select passwords during initial sync |
| Security | No clear text; double-hash encryption | May not meet ultra-restrictive compliance policies |
| Performance | Automatic; runs every 2 minutes | Sync delay for password changes |
| Resilience | Works even if on-prem AD is down | None significant |
| Administration | No maintenance beyond Entra Connect updates | No real-time lockout enforcement |
11. Real-World Example:
Scenario: Fabrikam Industries runs a traditional on-prem AD with 5,000 users. They’ve migrated their email and collaboration tools to Microsoft 365.
Their IT director wants users to sign in with the same credentials but doesn’t want to maintain a complex federation environment.
Solution:
Result: Users log in seamlessly to both their local Windows computers and cloud apps. The IT team doesn’t need to manage AD FS or authentication agents. If the on-prem AD is temporarily unavailable, cloud logins continue without interruption.
12. Exam Tips
13. Summary
Password Hash Synchronization is the simplest and most reliable method for enabling hybrid identity. It combines ease of deployment, high availability, and strong security — making it ideal for most organizations.
It’s the default and recommended method unless you have strict compliance or policy requirements that prevent password storage (even in hashed form) in the cloud.