Topic 2 of 5
Hybrid identity and external identities
Many organizations still run on-premises Active Directory while working with external partners and customers. This article covers how AD connects to Entra ID, where the password is validated in each method, and how to give outsiders access.
Contents
What is hybrid identity?
A common identity for authentication and authorization across all resources, whether on-premises or in the cloud. Users expect easy access to any application, wherever it's hosted.
Inter-directory provisioning
Creating an identity between two different directory services. The most common case: a user who already exists in Active Directory is provisioned into Entra ID.
Synchronization
Keeping on-premises user and group information matching the cloud.
Cloud Sync and Connect Sync
| Microsoft Entra Cloud Sync | Microsoft Entra Connect Sync | |
|---|---|---|
| Status | Recommended tool; new features are developed here | Earlier tool that Cloud Sync is replacing |
| What's installed on-premises | A lightweight provisioning agent (on-premises or in IaaS) | An on-premises sync server |
| Where configuration lives | In Entra ID, managed as part of the service | On the on-premises server |
| High availability | With multiple agents; supports disconnected forests | With a second server in staging mode |
The Cloud Sync agent uses SCIM (System for Cross-domain Identity Management), a standard for automating the exchange of user and group identity information between identity domains. The authentication method you choose works the same with either tool.
Where the password is validated
Choosing the authentication method is the first decision when moving apps to the cloud: it controls access to all data and resources and is the foundation of every other security feature. Changing it later takes planning and testing. There are two families:
Cloud authentication
Entra ID handles sign-in. Two options: PHS and PTA.
Federated authentication
Entra ID hands authentication to a separate trusted system, such as on-premises AD FS, which validates the password.
Password hash synchronization (PHS)
The simplest way to enable authentication for on-premises objects in Entra ID. Users use the same username and password as on-premises with no additional infrastructure. Passwords are never stored in clear text or with reversible encryption in Entra ID.
- Effort: the least for deployment, maintenance, and infrastructure. Hash sync runs every two minutes.
- Required by other features: ID Protection (leaked credentials report) and Microsoft Entra Domain Services require PHS, whatever the primary method.
- Limitation: it doesn't immediately enforce changes to on-premises account states. A disabled user keeps signing in to the cloud until the change syncs (up to about 30 minutes for disabled accounts).
- MFA: Entra MFA is used; third-party MFA that relies on federation isn't supported.
Pass-through authentication (PTA)
A software agent on one or more on-premises servers validates users directly against on-premises Active Directory, so password validation doesn't happen in the cloud.
- When: when on-premises account states, password policies, and sign-in hours must be enforced immediately.
- What it enforces: it denies access if the on-premises account is disabled, locked out, expired, has an expired password, or is outside its allowed hours.
- Infrastructure: lightweight agents on existing servers with access to domain controllers and outbound internet. They can't be deployed in a perimeter network. Microsoft recommends three agents in total for high availability.
- Backup: PHS can be a backup method, but the switch isn't automatic: you change the method manually with Entra Connect.
Federation with AD FS
Entra ID hands authentication to an external trusted system. Maintaining that system falls outside Entra ID's control and is the organization's responsibility.
When it's needed
- Third-party MFA providers that require federation
- Third-party authentication solutions
- Sign-in with sAMAccountName (DOMAIN\user) instead of UPN
- Low-latency multisite authentication systems
What it involves
- A farm of AD FS servers and proxy (WAP) servers in the perimeter network
- A TLS/SSL certificate and load balancing
- More investment and more complexity to operate and troubleshoot
- Usually chosen when that investment already exists
Comparing the three methods
| PHS | PTA | Federation | |
|---|---|---|---|
| Where authentication happens | In the cloud | In the cloud, after verifying with the on-premises agent | On-premises |
| Extra servers | None | One per additional agent | Several AD FS and WAP |
| Account states | Disabled accounts, with a delay | Disabled, locked out, expired, expired password, sign-in hours | The same as PTA |
| Federated third-party MFA | No | No | Yes |
| TLS certificate | No | No | Yes |
With PHS or PTA, if devices aren't Entra joined, Microsoft recommends enabling Seamless SSO to avoid unnecessary credential prompts.
Why always enable PHS
Microsoft recommends enabling PHS whatever the primary method, for three reasons:
High availability and disaster recovery
PTA and federation depend on on-premises infrastructure (servers, network, and domain controllers) that can fail. PHS serves as a backup if it was configured before the failure.
Surviving an on-premises outage
When ransomware took down on-premises servers, organizations that already had PHS switched methods and were back online in hours; those that didn't took weeks to restore their on-premises identity.
ID Protection
Microsoft searches the internet for leaked credentials and compares them with your organization's. That leaked credentials report (with P2) requires PHS.
Microsoft Entra External ID
It lets outsiders securely access your apps and resources with their own identities: corporate or government accounts, or social providers like Google or Facebook. It covers two scenarios, and each uses a different tenant configuration:
Workforce tenant
For employees, internal apps, and organizational resources. Partners and guests are invited here: collaborating with business guests.
External tenant
Used exclusively for External ID scenarios: publishing apps to consumers or business customers.
B2B collaboration
Share company apps and services with guests while keeping control of your data. You can invite anyone to sign in with their own credentials to access Office 365, SaaS, and line-of-business apps. Your tenant holds no credentials for the guest: they authenticate with their organization or provider, and your organization checks their eligibility to collaborate.
B2B direct connect
Creates mutual trust between two Entra organizations. Today it enables Teams Connect shared channels for chat, calls, and files. Unlike B2B collaboration, users aren't added as guests in your directory: they access directly from their home tenant.
CIAM (customers and consumers)
Microsoft's customer identity and access management solution: self-service sign-up, customized sign-in with social and enterprise SSO, and customer account management, with the security and scale of the Entra platform.
External ID core features are free for the first 50,000 monthly active users.
Exam scenarios
| Situation | Answer | Why |
|---|---|---|
| The company only uses Microsoft 365 and SaaS and wants the simplest option | PHS | Least deployment and maintenance effort, no extra infrastructure. |
| An account locked in on-premises AD must stop signing in to the cloud immediately | PTA | It validates against AD at every sign-in and enforces account states. |
| A third-party MFA that only works with federation is required | Federation (AD FS) | It's a requirement Entra doesn't cover natively. |
| You want to detect leaked credentials even though you use PTA | Also enable PHS | ID Protection's leaked credentials report requires PHS. |
| A new sync deployment | Microsoft Entra Cloud Sync | It's the recommended tool and where new features are developed. |
| Business partners access Teams and SharePoint with their own accounts | B2B collaboration | They're invited as guests to the workforce tenant. |
| A consumer commerce app with self sign-up and Google sign-in | External ID in an external tenant (CIAM) | Customer and consumer scenario. |
| Users from another organization in Teams shared channels without being guests | B2B direct connect | Mutual trust; they access from their home tenant. |
Common exam traps
❓ The company needs an account disabled in on-premises AD to be unable to sign in to Microsoft 365 immediately. PHS or PTA?
PTA: it validates against AD at every sign-in and enforces account states, expired passwords, and sign-in hours. PHS only reflects the change after syncing.
❓ With PHS, is the password stored in the cloud?
No. A hash is synced; passwords are never stored in clear text or with reversible encryption.
❓ With PTA, is the password validated in the cloud?
No. The on-premises agents validate it against Active Directory.
❓ If PTA fails, does it switch to PHS automatically?
No. PHS can be a backup, but the method change is done manually.
❓ Do B2B direct connect users appear as guests in your directory?
No. That's B2B collaboration. With B2B direct connect they access from their own tenant (Teams shared channels).
❓ Is a consumer app published from the workforce tenant?
No. An external tenant with External ID's CIAM capabilities is used.
❓ Which sync tool does Microsoft recommend for new deployments?
Microsoft Entra Cloud Sync. Connect Sync is the earlier tool being replaced.
Did you get this topic?
Test what you just learned
A company is building a consumer app and wants users to sign up on their own and sign in with Google or Facebook. What should it use?
Ready to test "Hybrid and external identities"?
Original questions, each with a full explanation.
Start a mock exam