cirsec Baselines
Esc
Microsoft 365 tenant · Identity & authentication

Enable password hash synchronization for synchronized identities

When it fails: Password hash synchronization is not enabled in a hybrid tenant. Microsoft cannot detect leaked passwords of synchronized users, and cloud sign-in depends entirely on on-premises federation or agents.

CB-M365-AUTH-044mediumactivemanualprofile baseline

Description

Password hash synchronization (PHS) is enabled in Microsoft Entra Connect Sync or Cloud Sync, even when users sign in through federation (AD FS) or pass-through authentication. The sync client sends a derived hash of the Active Directory password hash (PBKDF2 over the MD4 hash, salted per user) to Microsoft Entra ID; the original hash never leaves the network.

Enabling PHS does not change the sign-in method: federated domains stay federated until converted. Staged rollout lets you move groups of users to cloud authentication gradually.

Rationale

With PHS, ID Protection compares the users' credentials with passwords found in leaks and raises a Leaked credentials user risk (acted on by CB-M365-AUTH-030). PHS also keeps sign-in working if the federation servers or authentication agents fail or are attacked, and removes the need to expose AD FS to the internet once authentication moves to the cloud.

Impact

The first enablement synchronizes the hashes of all users in scope. Cloud passwords of synchronized users follow the on-premises policy and are set not to expire in the cloud. Some organizations object to storing any password-derived data in the cloud; the stored value cannot be used for pass-the-hash on-premises.

Applies when

Requires: Identities synchronized from Active Directory (Microsoft Entra Connect or Cloud Sync)

Setting

LocationMicrosoft Entra admin center > Entra ID > Entra Connect > Connect Sync (Password Hash Sync)
DefaultEnabled with express settings, optional with custom settings
RecommendedEnabled

Audit

  1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
  2. Browse to Entra ID > Entra Connect > Connect Sync and check that Password Hash Sync is shown as Enabled (for Cloud Sync, open the configuration and check Password hash sync).
  3. Alternative in PowerShell (Microsoft Graph, scope OnPremDirectorySynchronization.Read.All): (Get-MgDirectoryOnPremiseSynchronization).Features.PasswordSyncEnabled must return True.
  4. Check in Monitoring & health or in the sync server's event log that password hashes are synchronized without recurring errors.
  5. Fail if password hash synchronization is disabled.

Remediation

  1. On the Microsoft Entra Connect Sync server, run the Microsoft Entra Connect wizard as a local administrator, with a Hybrid Identity Administrator account in the tenant.
  2. Select Configure > Customize synchronization options (or Change user sign-in), and on the optional features page select Password hash synchronization.
  3. Complete the wizard; the initial hash synchronization starts automatically.
  4. For Cloud Sync, open Entra ID > Entra Connect > Cloud sync, edit the configuration and enable Password hash sync.
  5. Check in ID Protection that leaked credentials detections are now possible for synchronized users.

Rollback

Clear Password hash synchronization in the wizard. Hashes already stored are no longer used for sign-in in federated or PTA domains.

References

Mappings

FrameworkIDRelation
NIST SP 800-53 Rev. 55.1.1IA-5related
NIST SP 800-53 Rev. 55.1.1SI-4related

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

TaxonomyID
MITRE ATT&CKT1078.004
MITRE ATT&CKT1110.004
  • related CB-M365-AUTH-037 Enforce Microsoft Entra Password Protection on Windows Server Active Directory
  • related CB-M365-AUTH-045 Harden directory synchronization against cloud account takeover from Active Directory

People and lifecycle

Authors
Introduced inv0.1.0
Created, updated2026-10-24, 2026-10-24
Translationsfr