Your company has an on-premises Active Directory Domain Services (AD DS) environment. You want to sync users to Azure AD (Entra ID) using Azure AD Connect. Security policies dictate that user passwords must never be synchronized to the cloud, even in hashed form, but users must still be able to sign in to Microsoft 365 using their on-premises passwords. Which authentication method should you configure?

Direct Answer (Verified)Reviewed by Sunny (Senior Cloud Engineer)

Correct Answer: Pass-through Authentication (PTA)

Pass-through Authentication (PTA) allows users to sign in to cloud applications using their on-premises passwords without requiring the password hashes to be synchronized to the cl...

Real Exam ScenarioHybrid Identity

Your company has an on-premises Active Directory Domain Services (AD DS) environment. You want to sync users to Azure AD (Entra ID) using Azure AD Connect. Security policies dictate that user passwords must never be synchronized to the cloud, even in hashed form, but users must still be able to sign in to Microsoft 365 using their on-premises passwords. Which authentication method should you configure?

โœ“ Correct Answer & ExplanationHybrid Identity

Correct Answer

Pass-through Authentication (PTA)

Why This Answer Is Correct

Pass-through Authentication (PTA) allows users to sign in to cloud applications using their on-premises passwords without requiring the password hashes to be synchronized to the cloud. The authentication request is passed back to an on-premises PTA agent to validate against the local AD DS.

๐Ÿ“š What This Question Tests

This question evaluates your knowledge of Hybrid Identity โ€” a core concept tested in Microsoft Certified: Windows Server Hybrid Administrator Associate (AZ-800 & AZ-801). Understanding Hybrid Identity is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.