Does Password Hash Sync Meet the Password Policy Goal?

Why the Answer Is Correct

Password hash synchronization (PHS) continuously replicates a hash of each on-premises password into Microsoft Entra ID, so a cloud authentication succeeds even when the Active Directory forest is offline — this satisfies the first requirement. Microsoft's PHS documentation states that when password hash synchronization is enabled, the password complexity policies in your on-premises Active Directory instance override the complexity policies in the cloud for synchronized users. Because the Default Domain Policy is the container that legitimately holds the password policy for a domain, setting a minimum length of 10 characters there is exactly the supported mechanism for enforcing that length for synchronized identities. Both stated requirements are therefore met, and the answer is Yes.

Why the Other Options Are Wrong

Answer B claims the goal is not met, arguing that the password length should instead be configured in Entra ID; this overlooks the documented precedence rule that on-premises policy overrides cloud complexity policy for synchronized users, so an on-premises setting is sufficient and even authoritative. The alternative designs that exam takers sometimes reach for — Entra ID Password Protection, a cloud-only Password Protection lockout policy, or simply enabling Seamless single sign-on — are unnecessary for enforcing the minimum length of synchronized accounts. Note also that changing a custom GPO other than the Default Domain Policy would still work technically, but it is not needed here; the Default Domain Policy is the standard location for password settings, so the described change is valid. There is no conflict between PHS and domain password policy, because PHS only requires a writeback path for cloud-initiated resets, not a change in where policy is defined.

Community Comment Notes

Fran22 quoted Microsoft's documentation directly — "When password hash synchronization is enabled, the password complexity policies in your on-premises Active Directory instance override complexity policies in the cloud for synchronized users" — and selected the Yes answer. GMRS added that PHS "Syncs a hash of a user's on-premises password to Microsoft Entra ID" so "Cloud authentication succeeds even if your local Active Directory is offline," while the Default Domain Policy remains the source of the minimum-length rule. By contrast, Frank9020 argued that modifying the Default Domain Policy "DOES NOT ensure that the password policy is enforced in Entra ID" and voted No, which contradicts the documented override behavior; Vincent1966's reminder that the Default Domain Policy should hold the Password Policy actually supports the Yes verdict. LiamAzure and EEMS700 both agreed the solution is correct.