Active Directory Administration Cookbook

Password Hash Sync

Azure AD with Password Hash Sync (PHS) is the default authentication method when using Azure AD Connect with default settings. While Microsoft labeled this scenario as Password Hash Sync (PHS), they've made sure that neither the password itself, nor the hash of the password that is stored for the user object in Active Directory, is synchronized to Azure AD. Rather, a hash of the hash of the password is synchronized.

This is the only scenario where Active Directory is not leveraged for actual authentications. Therefore, no authentication events for sign-ins to cloud applications appear in the Windows Event Log of domain controllers. When an SIEM solution is present within the networking infrastructure, make sure it also ...