Azure AD Sign-in with PTA and Password Hash Sync Failure
Implement and manage hybrid identity
Answer
Correct answer: C — User1, User2, and User3 can all sign in because User1 is cloud-only, User3 is a guest, and User2 can use Password Hash Synchronization as a failover for failed Pass-through Authentication.
Your network contains an on-premises Active Directory domain that syncs to an Azure Active Directory (Azure AD) tenant. The tenant contains the users shown in the following table. [sampleXML/xmlfile-32_1.png] All the users work remotely. Azure AD Connect is configured in Azure AD as shown in the following exhibit. [sampleXML/xmlfile-32_2.png] Connectivity from the on-premises domain to the internet is lost. Which users can sign in to Azure AD?
Community Insight
Tests understanding of authentication method precedence and failover mechanisms in hybrid identity scenarios. The trap is assuming PTA failure blocks all synced users without recognizing PHS fallback capabilities.
Determines which users can sign in to Azure AD when on-premises connectivity is lost, considering Pass-through Authentication (PTA) and Password Hash Synchronization (PHS). The analysis clarifies that PHS acts as a failover for PTA-enabled synced users.
Many learners select User1 and User2 only, believing that because PTA fails due to connectivity loss, the synced user cannot authenticate. They overlook that Password Hash Synchronization provides an offline-capable backup.
Community Discussion (40 comments)
louismt
👍 1
Selected: C
PHS can be used as fallback for PTA
Ume1051
👍 1
Selected: C
From the exhibit: Password Hash Sync (PHS): Enabled Pass-through Authentication (PTA): Enabled Federation: Disabled Users: User Type Directory SyncedUser1 User No (cloud-only) User2 User Yes User3 Guest No When Password Hash Sync is enabled, synchronized users can continue to authenticate to Azure AD using the password hash stored in Azure AD, even if the on-premises environment or PTA agents are unavailable. Because the internet connectivity from the on-premises domain is lost: User1 (cloud-only user) can sign in ✅ User2 (synced user) can sign in using Password Hash Sync ✅ User3 (guest user) can still authenticate through the guest authentication mechanism ✅ Answer ✅ C. User1, User2, and User3
DATALORD
👍 1
Selected: A
In this hybrid identity setup with Azure AD Connect: Pass-through Authentication (PTA) is enabled (with 2 agents), and Password Hash Synchronization (PHS) is also enabled. PTA is the primary authentication method and takes precedence. PTA requires real-time communication between Azure AD and the on-premises PTA agents (which validate credentials against on-premises Active Directory). When connectivity from the on-premises domain to the internet is lost, the PTA agents cannot communicate with Azure AD. This prevents PTA-based authentication for directory-synced users (User2). Failover to PHS is not automatic; it requires manual intervention via Azure AD Connect.
Isuruvh
👍 1
Selected: C
c is correct
Lilianeze
👍 1
Selected: A
When PTA is in use and on-prem connectivity is down: Cloud-only and guest users can still authenticate to Azure AD. Directory-synced users cannot authenticate because PTA cannot validate their credentials.
Yassine1988
👍 2
Selected: A
User1 (Cloud-only user): Authenticates directly against Azure AD (no dependency on on-premises infrastructure). Can sign in. User2 (Synced user): Normally authenticates via PTA, which fails due to lost connectivity. Cannot sign in (unless PHS is used as a fallback, but PTA takes precedence here). User3 (Guest user): Authenticates via their home tenant (no dependency on on-premises infrastructure). Can sign in.
stefwanders
👍 1
Selected: A
Microsoft FAQ states: "No. Pass-through Authentication doesn't automatically failover to password hash synchronization. To avoid user sign-in failures, you should configure Pass-through Authentication for high availability." https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-pta-faq#does-password-hash-synchronization-act-as-a-fallback-to-pass-through-authentication-
krutesh
👍 2
Selected: C
Pass-through Authentication (PTA) validates users' passwords directly against on-premises Active Directory. It ensures on-premises security policies are enforced and does not store passwords in the cloud. Password Hash Synchronization (PHS) synchronizes a hash of user's password from on-premises Active Directory to Azure AD. It allows users to sign in to Azure AD using the same password they use on-premises. If both methods are enabled, PTA will take precedence for authentication. PHS can act as a backup, allowing users to sign in even if the PTA agent is temporarily unavailable.
Frank9020
👍 2
Selected: C
User1: Can sign in because they are not directory-synced and their account exists solely in Azure AD. User2: Can sign in because Password Hash Sync is enabled, allowing authentication to Azure AD even without on-premises connectivity. User3: Can sign in because guest accounts authenticate directly with their own identity provider and do not rely on the on-premises domain.
test123123
👍 2
Selected: C
By enabling Password Hash sync, you ensure that password hashes are synchronized to Azure AD, allowing users to authenticate even if the on-premises environment is unavailable. Password Hash sync is enabled, so answer is C.
test123123
👍 1
if your Azure AD Connect sync status shows "Password Hash Sync Enabled" and "Pass-Through Authentication Enabled," it means that users can still log on to Microsoft 365 even if the on-premises Active Directory loses internet connection.
SebArgy
👍 1
Selected: C
Reponse C. 1 - The password is sync 2 - TPHS ensures that users can authenticate to cloud services even if the on-premises AD is down. 3 - The tenant is not Federate, that means that tenant is Managed. Like that, you can directly authenticate with Entra.
AlexBrazil
👍 2
Selected: A
According to https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-pta-current-limitations: Enabling Password Hash Synchronization gives you the option to failover authentication if your on-premises infrastructure is disrupted. This failover from Pass-through Authentication to Password Hash Synchronization is not automatic. You'll need to switch the sign-in method manually using Microsoft Entra Connect. If the server running Microsoft Entra Connect goes down, you'll require help from Microsoft Support to turn off Pass-through Authentication.
Olami
👍 2
Connectivity to on-prems directory to the internet is lost, not the users' connectivity to the internet. I think User 1 and User 3 are not syncing with the on-prems directory. They are on the Azure AD. Only User 2 will have difficulty to sign in to Azure AD because of the Password Hash Sync btw on-prems and Azure AD. Answer is A
melatocaroca
👍 1
Answer C Both password hash sync and pass-through are enabled, no password change in the question, just login Only on-premises domain to the internet is lost User1 and User 3 are users that will log in with their hash in AAD, User3 is an AAD guest will log with his own credentials created guest on AAD, so IMHO answer must be C Pass-through Authentication does not automatically failover to password hash synchronization. To avoid user sign-in failures, you should configure Pass-through Authentication for high availability. The password hash synchronization process runs every 2 minutes. When a user attempts to sign into Azure AD and enters their password, the password is run through the same MD4+salt+PBKDF2+HMAC-SHA256 process. If the resulting hash matches the hash stored in Azure AD, the user has entered the correct password and is authenticated.
Jonasweimar
👍 1
https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-pta-current-limitations "Enabling Password Hash Synchronization gives you the option to failover authentication if your on-premises infrastructure is disrupted. This failover from Pass-through Authentication to Password Hash Synchronization is not automatic. You'll need to switch the sign-in method manually using Azure AD Connect. If the server running Azure AD Connect goes down, you'll require help from Microsoft Support to turn off Pass-through Authentication."
rachee
👍 6
C. Per https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-pta-current-limitations, Enabling Password Hash Synchronization gives you the option to failover authentication if your on-premises infrastructure is disrupted. The diagram shows Pasword Hash Synchronization is enabled.
Tuvshinjargal
👍 1
I agree with that. Since the Password Hash Synchronization is enabled, it must have been synched an hour ago, and also the password is saved in Azure AD. It remains when the on-premise AD lost the connection to the internet. See below article. https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-pta-faq When you use Microsoft Entra Connect to switch the sign-in method from password hash synchronization to Pass-through Authentication, Pass-through Authentication becomes the primary sign-in method for your users in managed domains. All users' password hashes that are previously synchronized by password hash synchronization remain stored on Microsoft Entra ID.
RahulX
👍 1
If password hash synchronization is enabled, all synced users can login with an AD pwd hash value if DC connectivity is lost, and if any user changes their pwd during this period, the hash will remain until the connection is restored. If you have enabled PTA earlier or have installed the PTA DC agent, it will show the pass-through authentication. Enabled 1 or 2 agents under User Sign-In status in azure ad portal.
simonseztech
👍 2
Selected: A
Does password hash synchronization act as a fallback to Pass-through Authentication? No. Pass-through Authentication does not automatically failover to password hash synchronization. To avoid user sign-in failures, you should configure Pass-through Authentication for high availability.
f2bf85a
👍 2
Selected: A
https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-pta-current-limitations#unsupported-scenarios Read the Note: Enabling Password Hash Synchronization gives you the option to failover authentication if your on-premises infrastructure is disrupted. This failover from Pass-through Authentication to Password Hash Synchronization is not automatic. You'll need to switch the sign-in method manually using Azure AD Connect. If the server running Azure AD Connect goes down, you'll require help from Microsoft Support to turn off Pass-through Authentication. Since the Password Hash sync failover is not automatic, in this case the answer is A. User2 that is directory sync will need Pass-Through Authentication, which will be unavailable at that moment.
NotanAdmin
👍 1
I got correct answer, but maybe my logic is off? All users work remotely, so wouldnt they log in to AAD, not on prem? Assuming User 2 uses a VPN to login through AD on-prem, I read it as User 2 is already synced. Therefore, A.
RahulX
👍 1
A. User1 and User3 only correct ans.
RahulX
👍 1
Sorry, The correct ans will be C. User1, User2, and User3.
EmnCours
👍 4
Selected: A
Correct Answer : A
Sango
👍 1
Answer A is correct. PTA is enabled which means no AD synced user auth will work until the issue is resolved. If both PHS and PTA are enabled (as per config) it is still a manual process (not mentioned in the question) to roll back to PHS. Microsoft: "Enabling Password Hash Synchronization gives you the option to failover authentication if your on-premises infrastructure is disrupted. This failover from Pass-through Authentication to Password Hash Synchronization is not automatic. You'll need to switch the sign-in method manually using Azure AD Connect. If the server running Azure AD Connect goes down, you'll require help from Microsoft Support to turn off Pass-through Authentication."
dule27
👍 2
Selected: A
A. User1 and User3 only
estyj
👍 1
Correct A. https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-pta-current-limitations
Tokiki
👍 1
Agree .A
bleedinging
👍 1
Correct. Only domain-synced users will be affected. Cloud users can still access cloud resources.
Sh1rub10
👍 1
Selected: A
only cloud users ( User 1 and User 3) can be authenticated
smosmo
👍 2
Selected: A
A is right. For the synced User no authentication will take place. Password hash synchronization does not act as a fallback to Pass-through Authentication. Pass-through Authentication does not apply to cloud-only users. So they can login.
AmazingKies
👍 19
Pass-through authentication is configured, Sync user will try to authenticate on local AD and unable to authenticate due to internet outage only cloud users ( User 1 and User 3) can be authenticated Correct Answer : A
examkid
👍 40
I think the answer is correct. When the connection to on-premise is lost, PTA will not work anymore. The failover to Password Hash Synchronization is not automatic and needs to be configured manually in AD Connect. If the connection to on-premise is lost, and the AD Connect server runs un-premise, user 2 cannot login. -~~~~~- Enabling Password Hash Synchronization gives you the option to failover authentication if your on-premises infrastructure is disrupted. This failover from Pass-through Authentication to Password Hash Synchronization is not automatic. You'll need to switch the sign-in method manually using Azure AD Connect. If the server running Azure AD Connect goes down, you'll require help from Microsoft Support to turn off Pass-through Authentication.
mbn
👍 2
correct; both password hash sync and passthrough are enabled, but no mention of failover initiated; thus user2 can't authenticate https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-pta-faq#does-password-hash-synchronization-act-as-a-fallback-to-pass-through-authentication
hhaywood
👍 3
Ah yes! I was reading 'not synced' the wrong way round and assumed they were on-prem users. Thanks yaniys!
hhaywood
👍 3
I must be missing something here? As only User 2 is synced to AAD with password has then sure this is the only user who can logon?
Azuredude123
👍 1
They have to sign in through on-prem, on-prem is down so they cannot sign in. Pass Hash sync and Pass through enabled.
yaniys
👍 3
User2's authentication still involves the AD. And as the connection is lost he is the only one who wouldn't be able to login as both the other users are cloud only
AS007
👍 1
Correct - pass hash sync enable so # 2 won’t authenticate
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
User1 is cloud-only and authenticates directly against Azure AD, so they are unaffected by on-premises connectivity loss. User3 is a guest user who authenticates via their home tenant, also independent of your on-premises infrastructure. User2 is a synced user configured with Pass-through Authentication (PTA), but the configuration also includes Password Hash Synchronization (PHS). According to Microsoft documentation, if PTA agents cannot reach the on-premises domain controller, PHS serves as a failover mechanism, allowing the user to authenticate using the synchronized password hash stored in Azure AD. Therefore, User2 can still sign in.Why the Other Options Are Wrong
Option A (User1 and User3 only) incorrectly assumes that PTA failure permanently locks out synced users. It ignores the explicit presence of Password Hash Synchronization in the diagram, which enables automatic failover. Option B (User1 only) excludes both the guest user and the synced user, failing to recognize that guests do not rely on your organization's on-premises resources and that PHS supports the synced user. Option D (User1 and User2 only) incorrectly includes User2 but excludes User3; while User2 can sign in via PHS, User3 (a guest) also has independent authentication paths and should be included.Community Comment Notes
Several commenters correctly identified that PHS allows failover, citing official Microsoft docs: "Enabling Password Hash Synchronization gives you the option to failover authentication if your on-premises infrastructure is disrupted". Others initially confused the scenario, thinking PTA was the sole method or misinterpreting 'not synced' statuses. One commenter noted, "Connectivity from the on-premises domain to the internet is lost... PTA will not work anymore," but correctly concluded that PHS saves the day for User2.Official Reference
Exam Strategy
Always check the synchronization configuration details in the exhibit. If both Pass-through Authentication and Password Hash Synchronization are enabled for a synced user, remember that PHS provides resilience against on-premises connectivity issues. Cloud-only and Guest users generally do not depend on your on-premises AD connectivity.
Frequently Asked Questions
Does Pass-through Authentication automatically failover to Password Hash Sync?
Yes, if both are enabled. When PTA agents lose connectivity to the on-premises DC, Azure AD falls back to validating the password hash synchronized via PHS.
Why can User3 (Guest) sign in during an on-prem outage?
Guest users authenticate against their own home tenant (identity provider), not your organization's on-premises Active Directory, so local connectivity issues do not affect them.
Related Analysis
Practice All SC-300 Questions
Access 80 questions with complete answers and detailed explanations.
View Full SC-300 Practice Test →