Does Password Hash Sync Meet the Password Policy Goal?
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your network contains an Active Directory forest. You deploy Microsoft 365. You plan to implement directory synchronization. You need to recommend a security solution for the synchronized identities. The solution must meet the following requirements: • Users must be able to authenticate successfully to Microsoft 365 services if Active Directory becomes unavailable. • User passwords must be 10 characters or more. Solution: Implement password hash synchronization and modify the password settings from the Default Domain Policy in Active Directory. Does this meet the goal?
Community Insight
The question tests whether on-premises password policy settings propagate to Entra ID through password hash synchronization; the trap is assuming that cloud-only Entra password settings must be configured separately.
This MS-102 case study asks whether password hash synchronization combined with a modified Active Directory Default Domain Policy satisfies both an AD-outage authentication requirement and a 10-character minimum password length. The page confirms that the solution works because on-premises complexity and length policies override cloud policies for synchronized users.
The most common wrong answer is B (No), because learners believe the 10-character length must be configured in Entra ID rather than in the Active Directory Default Domain Policy.
Community Discussion (7 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Password hash synchronization (PHS) continuously replicates a hash of each on-premises password into Microsoft Entra ID, so a cloud authentication succeeds even when the Active Directory forest is offline — this satisfies the first requirement. Microsoft's PHS documentation states that when password hash synchronization is enabled, the password complexity policies in your on-premises Active Directory instance override the complexity policies in the cloud for synchronized users. Because the Default Domain Policy is the container that legitimately holds the password policy for a domain, setting a minimum length of 10 characters there is exactly the supported mechanism for enforcing that length for synchronized identities. Both stated requirements are therefore met, and the answer is Yes.Why the Other Options Are Wrong
Answer B claims the goal is not met, arguing that the password length should instead be configured in Entra ID; this overlooks the documented precedence rule that on-premises policy overrides cloud complexity policy for synchronized users, so an on-premises setting is sufficient and even authoritative. The alternative designs that exam takers sometimes reach for — Entra ID Password Protection, a cloud-only Password Protection lockout policy, or simply enabling Seamless single sign-on — are unnecessary for enforcing the minimum length of synchronized accounts. Note also that changing a custom GPO other than the Default Domain Policy would still work technically, but it is not needed here; the Default Domain Policy is the standard location for password settings, so the described change is valid. There is no conflict between PHS and domain password policy, because PHS only requires a writeback path for cloud-initiated resets, not a change in where policy is defined.Community Comment Notes
Fran22 quoted Microsoft's documentation directly — "When password hash synchronization is enabled, the password complexity policies in your on-premises Active Directory instance override complexity policies in the cloud for synchronized users" — and selected the Yes answer. GMRS added that PHS "Syncs a hash of a user's on-premises password to Microsoft Entra ID" so "Cloud authentication succeeds even if your local Active Directory is offline," while the Default Domain Policy remains the source of the minimum-length rule. By contrast, Frank9020 argued that modifying the Default Domain Policy "DOES NOT ensure that the password policy is enforced in Entra ID" and voted No, which contradicts the documented override behavior; Vincent1966's reminder that the Default Domain Policy should hold the Password Policy actually supports the Yes verdict. LiamAzure and EEMS700 both agreed the solution is correct.Official Reference
Exam Strategy
For these series questions, evaluate each requirement independently against the single proposed solution rather than searching for a hybrid design. Remember the key MS-102 rule: on-premises password policy overrides Entra ID complexity policy for synchronized users, so PHS plus a correctly placed domain password policy is usually a valid answer.
Frequently Asked Questions
Why does setting password length in the Default Domain Policy affect Entra ID users?
When password hash synchronization is enabled, on-premises password complexity and length policies override the cloud policies for synchronized users, so the domain policy takes effect in Entra ID.
Can users still sign in to Microsoft 365 if the Active Directory forest is offline?
Yes. Password hash synchronization stores the password hash in Microsoft Entra ID, so cloud authentication succeeds even when the on-premises domain controllers are unavailable.
Related Analysis
Practice All MS-102 Questions
Access 111 questions with complete answers and detailed explanations.
View Full MS-102 Practice Test →