What's changed: Created SC-300 Chapter 2 (Domain 1 second-half: External ID/B2B collaboration/External collaboration settings/Cross-tenant access settings/cross-tenant sync; external IdP/direct federation/SAML/WS-Fed/social IdP; hybrid identity: Entra Connect Sync/Cloud Sync/PHS/PTA/seamless SSO/Connect Health/AD FS migration).
2.3Implementing hybrid identity
Understand Microsoft Entra Connect Sync and Cloud Sync, password hash synchronization (PHS)/pass-through authentication (PTA)/seamless SSO, Microsoft Entra Connect Health, and migrating from AD FS.
Many organizations have on-prem Active Directory (AD DS) and run hybrid identity to integrate it with Entra. Design the synchronization and authentication methods for availability and operational overhead.
2.3.1Entra Connect Sync and Cloud Sync
Two methods sync on-prem AD users/groups to Entra. Microsoft Entra Connect Sync is a single, feature-rich on-prem agent for complex filtering and large scale. Microsoft Entra Cloud Sync is a newer method configured from the cloud using lightweight provisioning agents (deploy several for high availability), suited to multiple forests or fragmented AD. Choose Cloud Sync for "lightweight, multi-agent HA, cloud-configured" and Connect Sync for "advanced transforms / single comprehensive sync."
2.3.2Authentication methods: PHS / PTA / SSO
Choose authentication by requirement. Password hash synchronization (PHS) syncs password hashes to Entra and authenticates in the cloud—simplest, and keeps authenticating during on-prem outages (also enables leaked-credential detection). Pass-through authentication (PTA) validates on an on-prem agent, for requirements not to store passwords in the cloud. Seamless SSO signs in domain-joined PCs on the corporate network without extra prompts. Architects recommend PHS (+ seamless SSO) unless there is a specific reason otherwise.
2.3.3Connect Health and migrating from AD FS
Microsoft Entra Connect Health monitors sync/auth agents’ health, errors, and performance. Many organizations are migrating from AD FS (complex, many failure points) to PHS or PTA (staged via Connect Health for AD FS or migration tooling). "Retire AD FS for cloud-leaning authentication" is a common SC-300 theme—consider migrating to PHS first.
Cues: "lightweight, multi-agent HA, multiple forests, cloud-configured" = Cloud Sync. "advanced transforms / single comprehensive sync" = Connect Sync. "simplest, keeps authenticating during outage" = PHS. "do not store passwords in the cloud" = PTA. "monitor sync/auth health" = Connect Health. "retire AD FS" = migrate to PHS/PTA.
Watch the mix-ups: (1) Distinguish Connect Sync (single, feature-rich) from Cloud Sync (lightweight, multi-agent). (2) PHS syncs a hash of the hash, not plaintext. (3) Hybrid-identity AD FS (your on-prem auth) differs from external-IdP federation (accepting guests, previous section).
2.3.4Section summary
- Sync = Connect Sync (single, feature-rich) or Cloud Sync (lightweight, multi-agent HA, multiple forests)
- Auth = PHS (simplest, resilient, default) / PTA (on-prem validation) / seamless SSO (no extra prompt)
- Monitor with Connect Health; AD FS is complex—consider migrating to PHS/PTA
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. You want to sync fragmented multi-forest AD to Entra using lightweight, highly available agents configured from the cloud. Which is best?
Q2. Which hybrid authentication method keeps working during a cloud-side outage and is simplest to operate?
Q3. Org policy requires "do not store passwords (including hashes) in the cloud." Which hybrid authentication fits?
Q4. You want to retire complex AD FS infrastructure for simpler, cloud-leaning authentication. What should you consider first?
Q5. You want to monitor the health, errors, and performance of sync/authentication agents. Which is best?