📖 What is Microsoft Entra Connect?
Microsoft Entra Connect is a synchronization tool that bridges on-premises Active Directory Domain Services with Microsoft Entra ID. It ensures that user identities, groups, and passwords are consistent across both environments, enabling a seamless single sign-on experience for hybrid users.
"Study the different synchronization modes, specifically Password Hash Synchronization (PHS) and Pass-Through Authentication (PTA), as these are high-value exam topics."
📚 Certification: Microsoft 365 Administrator (MS-102)
🔑 What are the Key Concepts of Microsoft Entra Connect?
- ▸ Password Hash Synchronization (PHS) sends a hash of the user's password hash to Entra ID, enabling cloud-based authentication and self-service password reset.
- ▸ Pass-Through Authentication (PTA) uses a local agent to validate passwords against on-premises Active Directory in real-time, ensuring passwords never leave the local environment.
- ▸ Federated identity using AD FS redirects authentication to an on-premises server, supporting complex requirements like smart cards or third-party MFA solutions.
- ▸ Staging Mode allows a secondary Entra Connect server to process imports and syncs without exporting changes, facilitating seamless migrations and disaster recovery.
- ▸ Domain and OU-based filtering ensures only specific users and groups are synchronized to the cloud, reducing noise and managing license consumption.
🎯 How does Microsoft Entra Connect appear on the MS-102 Exam?
You may be asked to recommend an authentication method for a company that requires passwords to remain strictly on-premises for compliance, but wants to avoid the complexity of AD FS.
A scenario might describe a need for the highest possible availability for cloud logins with minimal on-premises infrastructure; you should identify Password Hash Synchronization as the solution.
Expect questions about deploying a second Entra Connect server for high availability; you must explain how Staging Mode prevents duplicate objects and synchronization conflicts during the initial setup process.
❓ Frequently Asked Questions
What happens if the on-premises PTA agents go offline?
If all PTA agents are unavailable, users cannot authenticate. To prevent this, administrators often enable Password Hash Synchronization as a backup, allowing a failover to cloud-based authentication during outages.
When should I choose Federation over PTA or PHS?
Choose Federation when you need advanced authentication requirements, such as integrating with third-party MFA, using smart cards, or maintaining complete control over the authentication process on-premises.