Hybrid identity and sign-in methods
Most organizations still have Active Directory Domain Services (AD DS). SC-300 expects you to choose how those accounts reach Microsoft Entra ID (formerly Azure AD) and how users prove their password.
Two sync tools
| Microsoft Entra Connect Sync | Microsoft Entra Cloud Sync | |
|---|---|---|
| Runs as | Server with a sync engine | Lightweight agent(s) |
| Filtering | Domain, OU and attribute filtering | Scoping filters (OU, group, attribute) |
| Disconnected forests | Hard | Supported |
| Device writeback, Exchange hybrid | Yes | Limited |
Choose Cloud Sync for simple or multi-forest setups. Choose Connect Sync when you need advanced features.
Sign-in methods
- Password hash synchronization (PHS): a hash of the password hash is synced. Simplest and most resilient, and it enables leaked credential detection in Identity Protection. Microsoft recommends it.
- Pass-through authentication (PTA): the password is validated by on-premises agents at sign-in. On-premises lockout and logon-hour policies apply. The agents must be reachable.
- Federation (AD FS): authentication happens at your federation servers. It is the most complex and is needed for requirements such as on-premises smart card or third-party MFA.
You can enable PHS as a backup alongside PTA or federation.
Seamless single sign-on
Seamless SSO signs in domain-joined devices on the corporate network without extra prompts. It works with PHS or PTA, not with federation.
What happens if connectivity is lost
- PHS: cloud sign-in keeps working.
- PTA: sign-in fails unless PHS is also enabled.
- Federation: fails if the federation servers are unreachable.
Source of authority
Synced objects are managed on-premises. You change most attributes of a synced user in AD DS, not in the cloud. Password writeback is needed so self-service password reset (SSPR) can write the new password back to AD DS.
Exam traps
- PTA applies on-premises lockout policies; PHS does not.
- Seamless SSO is not a sign-in method on its own and does not work with federation.
- Cloud Sync handles disconnected forests, but it lacks some Connect Sync features.
- SSPR for synced users needs password writeback, which requires Entra ID P1 or higher.
- Filtering by OU is configured in the sync tool, not in Conditional Access.
Practice questions
Choose an answer, then review the explanation to check your understanding.
1. On-premises account lockout and logon-hour policies must apply to cloud sign-ins, and you want no federation servers. What should you use?
Show answer
Answer: B.Pass-through authentication validates the password against AD DS at sign-in, so on-premises policies apply. Password hash sync checks the hash in the cloud.
2. Internet connectivity from the on-premises network is lost. Which sign-in method still lets synced users sign in to Microsoft 365?
Show answer
Answer: C.With password hash sync the hash is already in Microsoft Entra ID, so cloud sign-in does not depend on the on-premises environment.
3. You need to sync several small, disconnected AD forests with a lightweight agent and no sync server. What do you deploy?
Show answer
Answer: B.Cloud Sync uses lightweight provisioning agents and supports multi-forest setups with disconnected forests.
4. You must stop a specific OU from syncing to Microsoft Entra ID. What do you configure?
Show answer
Answer: B.Scope what syncs with OU or attribute filtering in the sync tool.