# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-M365-AUTH-044
title: Enable password hash synchronization for synchronized identities
finding:
  title: Password hash synchronization is not enabled in a hybrid tenant
  description: Microsoft cannot detect leaked passwords of synchronized users, and cloud sign-in depends entirely on on-premises federation or agents.
status: active
profiles: [baseline]
risk:
  severity: medium
assessment: manual
tags: [hybrid, password-hash-sync, entra-connect, leaked-credentials, resilience]

applicability:
  requires:
    - "Identities synchronized from Active Directory (Microsoft Entra Connect or Cloud Sync)"

description: |
  Password hash synchronization (PHS) is enabled in Microsoft Entra Connect Sync or Cloud Sync, even
  when users sign in through federation (AD FS) or pass-through authentication. The sync client sends
  a derived hash of the Active Directory password hash (PBKDF2 over the MD4 hash, salted per user)
  to Microsoft Entra ID; the original hash never leaves the network.
rationale: |
  With PHS, ID Protection compares the users' credentials with passwords found in leaks and raises a
  **Leaked credentials** user risk (acted on by CB-M365-AUTH-030). PHS also keeps sign-in working
  if the federation servers or authentication agents fail or are attacked, and removes the need to
  expose AD FS to the internet once authentication moves to the cloud.
impact: |
  The first enablement synchronizes the hashes of all users in scope. Cloud passwords of synchronized
  users follow the on-premises policy and are set not to expire in the cloud. Some organizations
  object to storing any password-derived data in the cloud; the stored value cannot be used for
  pass-the-hash on-premises.
notes: |
  Enabling PHS does not change the sign-in method: federated domains stay federated until converted.
  Staged rollout lets you move groups of users to cloud authentication gradually.

setting:
  location: Microsoft Entra admin center > Entra ID > Entra Connect > Connect Sync (Password Hash Sync)
  default_value: Enabled with express settings, optional with custom settings
  recommended_value: Enabled

audit:
  manual: |
    1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a
       Global Reader.
    2. Browse to **Entra ID** > **Entra Connect** > **Connect Sync** and check that **Password Hash
       Sync** is shown as **Enabled** (for Cloud Sync, open the configuration and check **Password
       hash sync**).
    3. Alternative in PowerShell (Microsoft Graph, scope `OnPremDirectorySynchronization.Read.All`):
       `(Get-MgDirectoryOnPremiseSynchronization).Features.PasswordSyncEnabled`
       must return `True`.
    4. Check in **Monitoring & health** or in the sync server's event log that password hashes are
       synchronized without recurring errors.
    5. Fail if password hash synchronization is disabled.

remediation:
  manual: |
    1. On the Microsoft Entra Connect Sync server, run the Microsoft Entra Connect wizard as a local
       administrator, with a Hybrid Identity Administrator account in the tenant.
    2. Select **Configure** > **Customize synchronization options** (or **Change user sign-in**),
       and on the optional features page select **Password hash synchronization**.
    3. Complete the wizard; the initial hash synchronization starts automatically.
    4. For Cloud Sync, open **Entra ID** > **Entra Connect** > **Cloud sync**, edit the
       configuration and enable **Password hash sync**.
    5. Check in **ID Protection** that leaked credentials detections are now possible for
       synchronized users.
  rollback: |
    Clear **Password hash synchronization** in the wizard. Hashes already stored are no longer used
    for sign-in in federated or PTA domains.

references:
  - title: Implement password hash synchronization with Microsoft Entra Connect Sync
    url: https://learn.microsoft.com/entra/identity/hybrid/connect/how-to-connect-password-hash-synchronization
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: Microsoft Entra Connect Sync service features and configuration
    url: https://learn.microsoft.com/entra/identity/hybrid/connect/how-to-connect-syncservice-features
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
mappings:
  - framework: cis-m365
    framework_version: "7.0.0"
    id: "5.1.8.1"
    relation: equivalent
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: IA-5
    relation: related
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: SI-4
    relation: related
threats:
  - framework: mitre-attack
    id: T1078.004
  - framework: mitre-attack
    id: T1110.004
related_controls:
  - id: CB-M365-AUTH-037
    type: related
  - id: CB-M365-AUTH-045
    type: related

authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 0.1.0
created: 2026-10-24
updated: 2026-10-24