{
  "id": "CB-M365-AUTH-044",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-044",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-044.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-044.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUTH-044",
    "title": "Enable password hash synchronization for synchronized identities",
    "finding": {
      "title": "Password hash synchronization is not enabled in a hybrid tenant",
      "description": "Microsoft cannot detect leaked passwords of synchronized users, and cloud sign-in depends entirely on on-premises federation or agents."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "hybrid",
      "password-hash-sync",
      "entra-connect",
      "leaked-credentials",
      "resilience"
    ],
    "applicability": {
      "requires": [
        "Identities synchronized from Active Directory (Microsoft Entra Connect or Cloud Sync)"
      ]
    },
    "description": "Password hash synchronization (PHS) is enabled in Microsoft Entra Connect Sync or Cloud Sync, even\nwhen users sign in through federation (AD FS) or pass-through authentication. The sync client sends\na derived hash of the Active Directory password hash (PBKDF2 over the MD4 hash, salted per user)\nto Microsoft Entra ID; the original hash never leaves the network.\n",
    "rationale": "With PHS, ID Protection compares the users' credentials with passwords found in leaks and raises a\n**Leaked credentials** user risk (acted on by CB-M365-AUTH-030). PHS also keeps sign-in working\nif the federation servers or authentication agents fail or are attacked, and removes the need to\nexpose AD FS to the internet once authentication moves to the cloud.\n",
    "impact": "The first enablement synchronizes the hashes of all users in scope. Cloud passwords of synchronized\nusers follow the on-premises policy and are set not to expire in the cloud. Some organizations\nobject to storing any password-derived data in the cloud; the stored value cannot be used for\npass-the-hash on-premises.\n",
    "notes": "Enabling PHS does not change the sign-in method: federated domains stay federated until converted.\nStaged rollout lets you move groups of users to cloud authentication gradually.\n",
    "setting": {
      "location": "Microsoft Entra admin center > Entra ID > Entra Connect > Connect Sync (Password Hash Sync)",
      "default_value": "Enabled with express settings, optional with custom settings",
      "recommended_value": "Enabled"
    },
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Entra ID** > **Entra Connect** > **Connect Sync** and check that **Password Hash\n   Sync** is shown as **Enabled** (for Cloud Sync, open the configuration and check **Password\n   hash sync**).\n3. Alternative in PowerShell (Microsoft Graph, scope `OnPremDirectorySynchronization.Read.All`):\n   `(Get-MgDirectoryOnPremiseSynchronization).Features.PasswordSyncEnabled`\n   must return `True`.\n4. Check in **Monitoring & health** or in the sync server's event log that password hashes are\n   synchronized without recurring errors.\n5. Fail if password hash synchronization is disabled.\n"
    },
    "remediation": {
      "manual": "1. On the Microsoft Entra Connect Sync server, run the Microsoft Entra Connect wizard as a local\n   administrator, with a Hybrid Identity Administrator account in the tenant.\n2. Select **Configure** > **Customize synchronization options** (or **Change user sign-in**),\n   and on the optional features page select **Password hash synchronization**.\n3. Complete the wizard; the initial hash synchronization starts automatically.\n4. For Cloud Sync, open **Entra ID** > **Entra Connect** > **Cloud sync**, edit the\n   configuration and enable **Password hash sync**.\n5. Check in **ID Protection** that leaked credentials detections are now possible for\n   synchronized users.\n",
      "rollback": "Clear **Password hash synchronization** in the wizard. Hashes already stored are no longer used\nfor sign-in in federated or PTA domains.\n"
    },
    "references": [
      {
        "title": "Implement password hash synchronization with Microsoft Entra Connect Sync",
        "url": "https://learn.microsoft.com/entra/identity/hybrid/connect/how-to-connect-password-hash-synchronization",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Microsoft Entra Connect Sync service features and configuration",
        "url": "https://learn.microsoft.com/entra/identity/hybrid/connect/how-to-connect-syncservice-features",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-5",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-4",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1078.004"
      },
      {
        "framework": "mitre-attack",
        "id": "T1110.004"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUTH-037",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-045",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}