Turn on Password Hash Sync (PHS) Between Active Directory and Microsoft Entra ID

Password Hash Synchronization (PHS) sends a hash of a hash of each on-premises Active Directory user password to Microsoft Entra ID roughly every 2 minutes. The original password never leaves your network, and the synchronized value cannot be replayed against AD. Despite the name, PHS does not upload usable credentials — it uploads a salted, 1,000-iteration PBKDF2-SHA256 derivative of the AD NT hash.

PHS matters for three reasons. First, it is the only sign-in method that enables Entra ID Protection's leaked credential detection — Microsoft compares your synchronized hashes against billions of credentials found in breach dumps and dark web dark markets, and flags users whose passwords are already public. With ADFS or Pass-through Authentication alone, you are blind to this. Second, it provides authentication resilience: if your domain controllers, ADFS farm, PTA agents, or internet link go down, users can still sign in to Microsoft 365 and other cloud apps. Third, it is a prerequisite step on the road to cloud-first and passwordless authentication.

Even organizations that intentionally use federation or PTA as their primary method should enable PHS as a backup. There is no downside, and the failover is a single toggle away during an outage.

Implementation steps

• Confirm your sync tooling. Verify you are running a supported version of Microsoft Entra Connect Sync or Entra Cloud Sync. Deprecated builds are blocked from syncing.
• Verify the service account permissions. The AD DS connector account needs Replicating Directory Changes and Replicating Directory Changes All on the domain. Without both, hash sync silently fails.
• Enable PHS in Entra Connect. Launch Entra Connect on the sync server → Configure → Change user sign-in → select Password Hash Synchronization → check Enable single sign-on (Seamless SSO) if you are not already using Hybrid Entra Join → complete the wizard.
• If you use ADFS or PTA, keep them primary but tick PHS. In the same wizard, choose your existing method and enable the Enable password hash synchronization checkbox. This stages hashes in the cloud without changing user sign-in behavior.
• Force an initial full sync. Run Start-ADSyncSyncCycle -PolicyType Initial in PowerShell, or use the Set-ADSyncAADPasswordSyncConfiguration cmdlet to trigger a full password hash resync.
• Validate. Check the sync server's Application log for Event ID 656 (hash sent) and 657 (hash successfully synced). In the Entra admin center, confirm Entra Connect → Password Hash Sync: Enabled and inspect a test user's lastPasswordChangeDateTime.
• Turn on the payoff. Go to Entra ID Protection and configure risk-based Conditional Access policies so users flagged with Leaked credentials are forced through password reset or blocked. PHS without this step gives you resilience but not detection.
• Document the failover procedure. Write down the exact steps to switch sign-in from ADFS/PTA to PHS so the on-call team can execute it under pressure during an outage.

Related hardening items

• Enforce MFA and Block Legacy Authentication with Conditional Access — required alongside PHS; hash sync alone does not stop a valid stolen password.
• Develop a Credential Strategy (Including Passwordless Authentication) — PHS is the foundation this strategy builds on.
• Install Microsoft Defender for Identity Sensor on All Domain Controllers — pairs with PHS to correlate on-premises and cloud identity signals.
• Enable LSA Protection and Credential Guard — protects the on-premises hashes at the source.