Microsoft Entra Connector: Password Hash Sync Now Automatically Enabled for Enhanced Security

Table of Contents

Microsoft Entra Connect plays a pivotal role in synchronizing on-premises Active Directory identities with Microsoft Entra ID (formerly Azure Active Directory). This critical component facilitates a seamless hybrid identity experience, enabling users to access both on-premises and cloud resources with a single set of credentials. Among its various synchronization capabilities, Password Hash Synchronization (PHS) and Pass-through Authentication (PTA) are two primary methods for user sign-in to Microsoft Entra ID. Understanding their functionality and ensuring their correct configuration is paramount for maintaining a secure and efficient identity infrastructure.

This article addresses specific issues encountered in earlier versions of Microsoft Entra Connect where Password Hash Synchronization was unexpectedly enabled, even when Pass-through Authentication was the intended sign-in method. Such a scenario can lead to unintended storage of password hashes in the cloud, potentially conflicting with an organization’s security policies or compliance requirements. We will delve into the problems, their root causes, and provide detailed steps for resolution, emphasizing the importance of utilizing the latest, stable versions of Microsoft Entra Connect for optimal security and functionality.

Understanding Authentication Methods in Microsoft Entra Connect¶

Before diving into the specifics of the issue, it is crucial to understand the two main password authentication methods offered by Microsoft Entra Connect:

Password Hash Synchronization (PHS)¶

Password Hash Synchronization is the simplest way to enable authentication for cloud-based services with Microsoft Entra ID. With PHS, a hash of the user’s password hash from the on-premises Active Directory is synchronized to Microsoft Entra ID. This is a one-way synchronization, meaning the original password or its hash cannot be retrieved from Microsoft Entra ID. When a user attempts to sign in to Microsoft Entra ID, the service compares the supplied password with the stored hash. This method offers high availability as authentication requests are handled entirely by Microsoft Entra ID, reducing reliance on on-premises infrastructure for cloud sign-ins.

Pass-through Authentication (PTA)¶

Pass-through Authentication provides a simpler alternative to federated authentication for Microsoft Entra ID. It allows users to sign in to both on-premises and cloud-based applications using the same passwords. When a user attempts to sign in via PTA, Microsoft Entra ID sends the username and password to an authentication agent running on an on-premises server. This agent then validates the credentials directly against the on-premises Active Directory, effectively “passing through” the authentication request. No password hashes are stored in Microsoft Entra ID with this method, which is a key differentiator for organizations with stringent security policies requiring all authentication to occur against their on-premises domain controllers.

Critical Issues Affecting Microsoft Entra Connect Versions¶

Several versions of Microsoft Entra Connect have been identified with issues specifically impacting the Change user sign-in task. These problems can lead to unintended consequences, particularly for deployments relying on Pass-through Authentication. The affected versions include:

• 1.1.557.0
• 1.1.558.0
• 1.1.561.0
• 1.1.614.0

These specific versions have demonstrated behaviors that diverge from expected configurations, primarily concerning the automatic enablement of Password Hash Synchronization when Pass-through Authentication is the desired and configured method. This can be problematic for organizations that explicitly choose PTA to avoid storing any form of password hashes in the cloud. The good news is that these critical issues have been thoroughly addressed and resolved in Microsoft Entra Connect version 1.1.644.0 and later releases. Organizations are strongly advised to upgrade to the latest available version to benefit from these fixes and enhanced security.

Problem 1: Password Synchronization Enabled with Pass-through Authentication¶

One of the primary concerns with the affected versions is the automatic enablement of Password Hash Synchronization (PHS) even when Pass-through Authentication (PTA) is the chosen sign-in method. This can occur under specific scenarios, leading to an unexpected configuration state.

Scenario 1¶

Consider an existing Microsoft Entra Connect deployment where both Password Hash Synchronization and Pass-through Authentication have been intentionally disabled. The administrator then decides to enable Pass-through Authentication using the Change user sign-in task within the Microsoft Entra Connect wizard. Contrary to the administrator’s intent of only enabling PTA, the process inadvertently also enables Password Hash Synchronization. This creates a dual-authentication setup where PHS runs in the background, potentially without the administrator’s knowledge or approval, violating the initial design choice to rely solely on PTA for certain security postures.

Scenario 2¶

In another instance, an organization might have an existing Microsoft Entra Connect deployment with Password Hash Synchronization disabled and Pass-through Authentication already enabled. Subsequently, the administrator uses the Change user sign-in task to modify the Seamless Single Sign-on option – either enabling or disabling it. Unexpectedly, this action triggers the automatic enablement of Password Hash Synchronization. This scenario highlights how seemingly unrelated configuration changes via the wizard could inadvertently alter the core password synchronization method, impacting the security architecture that was carefully established. Such an event could lead to compliance issues for organizations that have strict policies against storing password hashes outside their on-premises environment.

Background Information About This Issue¶

Historically, prior to Microsoft Entra Connect version 1.1.557.0, Password Hash Synchronization was considered a prerequisite for enabling Pass-through Authentication. This design choice meant that whenever PTA was enabled, PHS would also be automatically activated as a dependency. This approach ensured a baseline level of authentication functionality but limited flexibility for organizations with specific security requirements.

Recognizing the evolving needs for more granular control over authentication methods, the process was redesigned in Microsoft Entra Connect version 1.1.557.0. The intention was to decouple PHS from PTA during the initial installation of Microsoft Entra Connect. This change aimed to allow administrators to enable Pass-through Authentication without automatically enabling Password Hash Synchronization, providing greater flexibility and adherence to varying security policies.

However, an oversight occurred: this crucial change was not consistently applied to the Change user sign-in task within the Microsoft Entra Connect wizard. As a result, if an administrator used this task to enable Pass-through Authentication on an existing Microsoft Entra Connect deployment, the legacy logic would still apply, leading to Password Hash Synchronization being automatically enabled. This inconsistency between installation behavior and post-installation modification behavior was the root cause of Problem 1. The issue has since been rectified in Microsoft Entra Connect version 1.1.644.0, ensuring that Password Hash Synchronization remains disabled when Pass-through Authentication is enabled or modified via the Change user sign-in task, aligning the behavior across all configuration pathways.

Problem 2: Incorrect Prompt About Disabled Password Synchronization¶

Another significant issue observed in the affected versions relates to the messaging and prompts displayed to administrators. This problem specifically arises when Password Hash Synchronization is already enabled, but Pass-through Authentication is being configured.

Consider a scenario where an existing Microsoft Entra Connect deployment has Password Hash Synchronization enabled and Pass-through Authentication disabled. An administrator then decides to enable Pass-through Authentication using the Change user sign-in task. In this situation, Password Hash Synchronization should, by design, remain enabled. However, the wizard in the problematic versions would sometimes display an incorrect prompt or message implying that Password Hash Synchronization would be disabled, leading to confusion and potential misconfiguration assumptions for the administrator. While the underlying configuration might still be correct (PHS remains enabled), the misleading user interface could cause unnecessary concern or lead to incorrect subsequent actions.

Background Information About This Issue¶

By design, if Password Hash Synchronization is already active, changing the user sign-in method to another option, such as Pass-through Authentication, does not automatically disable PHS. This behavior ensures that if PHS was intentionally enabled for its resilience benefits, it would not be inadvertently turned off. The problem in the affected versions was purely a user interface issue, where the prompt window incorrectly suggested that PHS would be disabled. This created a discrepancy between the expected behavior and the displayed information. This specific UI bug has also been addressed and corrected in Microsoft Entra Connect version 1.1.644.0, ensuring that administrators receive accurate information regarding the status of Password Hash Synchronization during configuration changes.

Resolution Steps for Password Hash Synchronization Issues¶

To effectively resolve these issues and ensure your Microsoft Entra Connect deployment is configured precisely to your organizational requirements, especially concerning Password Hash Synchronization and Pass-through Authentication, follow these detailed steps. It is highly recommended to upgrade your Microsoft Entra Connect instance to version 1.1.644.0 or later before proceeding with these steps to prevent recurrence of the described problems.

Step 1: Verify Current Password Synchronization Configuration¶

The first action is to confirm the current state of Password Hash Synchronization on your tenant. This verification is crucial to understand if PHS is indeed enabled, potentially without your explicit intent.

1. Launch Microsoft Entra Connect: Open the Microsoft Entra Connect wizard on the server where it is installed.
2. Select ‘View current configuration’: On the welcome screen or the main menu, choose the option to View current configuration. This will allow you to inspect the active settings of your synchronization service.
3. Review details pane: In the details pane that appears, carefully examine the listed features. Look specifically for Password synchronization. Note whether its status is displayed as enabled or disabled for your tenant. This step confirms the actual operational status. If it shows as enabled and you wish it to be disabled, proceed to the next step.

Step 2: Disable the Password Synchronization Feature¶

If you have verified that Password Hash Synchronization is enabled and your intention is to use Pass-through Authentication exclusively (or to not use PHS at all), you must explicitly disable the feature.

1. Run Microsoft Entra Connect: Open the Microsoft Entra Connect wizard again.
2. Select ‘Configure’: On the initial screen, choose the Configure option to make changes to your synchronization settings.
3. Choose ‘Customize synchronization options’: In the subsequent configuration options, select the task labeled Customize synchronization options. This will lead you through a series of wizard pages where you can modify various features.
4. Navigate to ‘Optional features’ page: Proceed through the wizard until you reach the Optional features page. This page lists various synchronization features that can be enabled or disabled.
5. Clear ‘Password synchronization’ check box: On the Optional features page, locate the Password synchronization feature. Ensure that the corresponding check box is cleared. This action explicitly instructs Microsoft Entra Connect to disable Password Hash Synchronization.
6. Complete the wizard: Click Next through the remaining pages, reviewing any other configurations as needed, and then click Configure (or Install if it’s the final button) to apply your changes. Microsoft Entra Connect will then restart its synchronization services to implement the new configuration.

Optional: Clearing Existing Password Hashes from Microsoft Entra ID¶

If Password Hash Synchronization was inadvertently enabled for a period, it is possible that password hashes have already been synchronized to Microsoft Entra ID. For organizations with strict security or compliance mandates, clearing these stored hashes might be a necessary action. This process requires careful execution and an understanding of the implications.

Step 1: Ensure Password Writeback Feature is Disabled¶

Before attempting to clear any synchronized password hashes, it is critically important to verify that the Password Writeback feature is disabled on your tenant. Password Writeback allows users to change or reset their passwords in the cloud, and then have those new passwords written back to their on-premises Active Directory. If this feature were active while you attempt to clear cloud hashes, it could potentially re-synchronize old or unintended hashes, or even interfere with the hash clearing process.

1. Run Microsoft Entra Connect: Open the Microsoft Entra Connect wizard.
2. Select ‘Configure’: Choose the Configure option.
3. Choose ‘Customize synchronization options’: Select the Customize synchronization options task.
4. Navigate to ‘Optional features’ page: Proceed to the Optional features page within the wizard.
5. Clear ‘Password writeback’ check box: Locate the Password writeback feature. Ensure that its corresponding check box is cleared. This guarantees that no password changes originating from Microsoft Entra ID will be written back to your on-premises environment during this sensitive operation.
6. Complete the wizard: Click Next through the wizard pages and then Configure to apply this change.

Step 2: Use PowerShell to Reset User Passwords and Clear Hashes¶

Once Password Writeback is confirmed to be disabled, you can proceed with clearing the stored password hashes. Microsoft Entra ID maintains a history of the last four password hashes for each user for security and recovery purposes. To effectively clear all historical hashes, you must reset the user’s password multiple times, specifically five times, using a PowerShell cmdlet. This action will overwrite the entire hash history with new, random hashes.

You will use the Reset-MgUserAuthenticationMethodPassword cmdlet from the Microsoft Graph PowerShell SDK. Ensure you have the Microsoft Graph PowerShell module installed and are connected to Microsoft Graph with appropriate permissions (e.g., User.ReadWrite.All).

Example PowerShell Script (Conceptual):

# Install Microsoft Graph PowerShell SDK if not already installed
# Install-Module Microsoft.Graph -Scope CurrentUser

# Connect to Microsoft Graph with necessary permissions
# Connect-MgGraph -Scopes "User.ReadWrite.All"

# Define the User Principal Name (UPN) of the affected user
$userPrincipalName = "user@yourdomain.com"

# Retrieve the user object
$user = Get-MgUser -UserId $userPrincipalName -ErrorAction Stop

if ($user) {
    Write-Host "Resetting password hashes for user: $($user.UserPrincipalName)"
    # Reset password 5 times to clear the hash history
    for ($i = 1; $i -le 5; $i++) {
        Write-Host "Performing password reset iteration $i..."
        # Generate a new random password for each reset
        $newRandomPassword = ([char[]]([char]48..57 + [char]65..90 + [char]97..122 | Get-Random -Count 20)) -join ''

        # Reset the user's password using the cmdlet
        try {
            Reset-MgUserAuthenticationMethodPassword -UserId $user.Id -NewPassword $newRandomPassword -ForceChangePasswordNextSignIn:$false
            Write-Host "   Password reset successful for iteration $i."
        } catch {
            Write-Error "   Failed to reset password for iteration $i: $($_.Exception.Message)"
            break # Exit loop if a reset fails
        }
        Start-Sleep -Seconds 1 # Small delay to avoid throttling
    }
    Write-Host "Password hash clearing process completed for $($user.UserPrincipalName)."
} else {
    Write-Error "User with UPN '$userPrincipalName' not found."
}

# Remember to disconnect from Graph when done
# Disconnect-MgGraph

Important Notes for PowerShell Execution:

• Run for each affected user: This cmdlet needs to be executed for every user whose password hashes you wish to clear from Microsoft Entra ID. For a large number of users, you should script this operation, iterating through a list of affected User Principal Names (UPNs).
• Five resets required: As mentioned, Microsoft Entra ID stores the last four password hashes. Resetting the password five times ensures that all previous hashes are overwritten with new, random hashes, effectively clearing any sensitive historical data.
• Federated domain users: If the cmdlet fails for a federated domain user, a workaround might be necessary. Temporarily change the User Principal Name (UPN) of the user to a non-federated domain (e.g., from user@federated.com to user@yourtenant.onmicrosoft.com). After the UPN change, run the Reset-MgUserAuthenticationMethodPassword cmdlet the required five times. Once the hashes are cleared, revert the user’s UPN back to its original federated domain. This temporarily bypasses any federation-specific authentication path that might prevent direct password resets via Graph API.
• User Impact: Be aware that performing these password resets, even with random passwords, might have a temporary impact on user accounts if not handled carefully, especially if ForceChangePasswordNextSignIn is set to $true (it’s set to $false in the example to minimize impact). The user’s actual on-premises password remains unchanged; only the hashes in Entra ID are affected. If you are using PTA, this should have minimal impact on user sign-in experience as authentication still happens on-prem.

Importance of Keeping Microsoft Entra Connect Updated¶

The issues discussed in this article underscore a crucial best practice: regularly updating Microsoft Entra Connect to its latest version. Microsoft consistently releases updates that include:

• Security fixes: Patches for newly discovered vulnerabilities, protecting your hybrid identity environment from potential threats.
• Bug fixes: Resolution of issues like the ones described, ensuring stable and predictable operation.
• New features: Introduction of enhanced capabilities and improved integration with Microsoft Entra ID.
• Performance improvements: Optimizations that can make synchronization faster and more efficient.

Staying current with Microsoft Entra Connect versions minimizes exposure to known issues, ensures compliance with evolving security standards, and allows organizations to leverage the full potential of their hybrid identity solutions. Microsoft provides an automatic upgrade feature for Microsoft Entra Connect, which can be configured to keep your installation up-to-date with minimal administrative overhead.

Conclusion¶

The automatic enablement of Password Hash Synchronization in earlier versions of Microsoft Entra Connect when Pass-through Authentication was intended represented a significant configuration oversight. These issues, while subtle, could have profound implications for an organization’s security posture and compliance. Fortunately, Microsoft has addressed these problems in version 1.1.644.0 and subsequent releases, reinforcing the commitment to robust and secure hybrid identity management.

By understanding the distinct roles of Password Hash Synchronization and Pass-through Authentication, verifying your current configuration, and diligently applying the provided resolution steps, organizations can ensure their Microsoft Entra Connect deployment aligns perfectly with their security policies. The optional process of clearing historical password hashes further empowers administrators to maintain the highest level of data integrity in Microsoft Entra ID. Always remember that a well-maintained and regularly updated Microsoft Entra Connect instance is the cornerstone of a resilient and secure hybrid identity infrastructure.

What are your experiences with configuring different authentication methods in Microsoft Entra Connect? Have you encountered similar unexpected behaviors, or do you have any tips for managing your hybrid identity environment effectively? Share your thoughts and questions in the comments below!