2.1MS-102Advanced
Est: ~15 mins•Verified: 2026-08

Entra Connect Sync: Password Hash Sync & Staging

Deploy, monitor, and maintain Microsoft Entra Connect Sync with Password Hash Sync (PHS), filtering, and Staging Mode for seamless hybrid identity synchronization.

Tags:#Entra Connect#Hybrid Identity#PHS#Password Hash Sync#Staging Mode#MS-102
01

Overview

Microsoft Entra Connect Sync (and the lightweight Microsoft Entra Cloud Sync) synchronizes on-premises Active Directory Domain Services (AD DS) objects (users, security groups, contacts, and computers) into Microsoft Entra ID.

The core authentication architectures supported are:

  1. Password Hash Synchronization (PHS) [Microsoft Recommended]: Hashes of user password hashes (SHA-256 HMAC) are securely synchronized from Active Directory to Microsoft Entra ID. Users sign in using the same password without relying on on-premises domain controller uptime.
  2. Pass-Through Authentication (PTA): Password validation is forwarded in real-time via outbound-only agents to on-premises domain controllers.
  3. Federation (AD FS): Delegated authentication to on-premises ADFS servers.
  4. Staging Mode (High Availability): A secondary passive Entra Connect server that reads AD and Entra ID changes and stages imports without writing back, enabling instant failover.

---

02

When to Use

Authentication MethodOn-Premises DependencyCloud ResiliencyCompromised Credential Detection
Password Hash Sync (PHS)None for authentication100% Cloud ResilientSupported (Dark Web credential matching via Entra Identity Protection).
Pass-Through Auth (PTA)High (Requires on-prem agent)Fails if on-prem internet dropsNot supported without PHS backup.
Federation (AD FS)Extreme (Requires ADFS farm + WAP)Fails if ADFS infrastructure dropsComplex integration.

---

03

Prerequisites

Infrastructure Requirements:

  • Windows Server 2016 or later joined to the Active Directory domain.
  • Active Directory Schema version 2008 R2 or later.
  • Microsoft .NET Framework 4.6.2+.
  • Outbound HTTPS (port 443) access to .msappproxy.net, .servicebus.windows.net, and login.microsoftonline.com.

Administrative Credentials:

  • Enterprise Administrator in Active Directory (to configure AD DS Connector account and SCP).
  • Hybrid Identity Administrator or Global Administrator in Microsoft Entra ID.

---

04

Portal Path

TEXT
Microsoft Entra Admin Center (https://entra.microsoft.com)
└── Identity
    └── Hybrid management
        └── Microsoft Entra Connect
            ├── Connect Sync (Sync status, Password Hash Sync, Last sync time)
            └── Cloud Sync (Agent monitoring for cloud sync agents)

---

05

Step-by-Step Implementation

Step 1: Install & Configure Microsoft Entra Connect

  1. Download Microsoft Entra Connect from official Microsoft Download Center onto the dedicated sync server.
  2. Launch AzureADConnect.exe > Click Customize.
  3. Select sign-in method: Password Hash Synchronization > Check Enable single sign-on (Seamless SSO).
  4. Connect to Microsoft Entra ID using Hybrid Identity Administrator credentials.
  5. Connect to Active Directory: Add directory forest > Select Create new AD DS account.
  6. Uniquely identifying your users: Select UPN as userPrincipalName.
  7. Domain and OU filtering: Select Sync selected domains and OUs > Check only corporate production OUs (e.g., OU=CorpUsers,DC=contoso,DC=com).
  8. Select optional features:
  • Password writeback (Enables Self-Service Password Reset to update on-prem AD).
  • Exchange hybrid deployment.
  1. Complete setup and trigger initial full synchronization.

Step 2: Configure a Secondary Server in Staging Mode (Disaster Recovery)

  1. Install Microsoft Entra Connect on a secondary member server.
  2. Select identical configuration settings (OUs, attribute flows, PHS).
  3. On the Ready to configure screen, check Enable staging mode.
  4. The staging server imports objects and calculates delta syncs but never exports changes to Active Directory or Microsoft Entra ID.
  5. In case of primary server failure: Run wizard on primary > Check Enable staging mode; Run wizard on secondary > Uncheck Staging mode to promote it to active.

---

06

PowerShell Automation

Trigger Manual Delta and Full Synchronization Cycles:

PowerShell
# Run on active Entra Connect server in elevated PowerShell
Import-Module ADSync

# Check current sync scheduler state
Get-ADSyncScheduler

# Trigger a Delta Synchronization (standard 30-minute cycle)
Start-ADSyncSyncCycle -PolicyType Delta

# Trigger a Full Synchronization (after modifying OU filters or sync rules)
Start-ADSyncSyncCycle -PolicyType Initial

Inspect Password Hash Sync (PHS) Status:

PowerShell
# Verify Password Hash Synchronization health
Get-ADSyncAADPasswordResetConfiguration -ConnectorName "contoso.com"
Invoke-ADSyncDiagnostics -PasswordHashSynchronization

---

07

Microsoft Graph Automation

Query Sync Status and Last Sync Time via Graph:

PowerShell
Connect-MgGraph -Scopes "Organization.Read.All"

# Query synchronization state of tenant
Get-MgOrganization | Select-Object displayName, onPremisesSyncEnabled, onPremisesLastSyncDateTime

---

08

Verification Checklist

VERIFICATION CHECKLIST
0/5 (0%)
Microsoft Entra Admin Center shows Directory sync enabled : Yes and Password Hash Sync : Enabled.
Users created in on-premises AD sync into Entra ID within 30 minutes.
Changing an on-premises AD password syncs to Entra ID in under 2 minutes.
Synchronization Service Manager (miisclient.exe) displays status success for import, sync, and export profiles.
Staging server logs show successful imports with zero exports.
09

Diagnostic Logs & Channels

Tool / LocationPathPurpose
Synchronization Service ManagerC:\Program Files\Microsoft Azure AD Sync\UIShell\miisclient.exeVisual tracking of individual connector operations, delta imports, and attribute sync errors.
Application Event LogEvent Viewer > Windows Logs > Application (Source Directory Synchronization)Records scheduler triggers, service start/stop events, and connector run profiles.
AADConnect Troubleshooting ToolDesktop shortcut or Invoke-ADSyncDiagnosticsDiagnoses object sync drops, UPN mismatches, and PHS heartbeat issues.

---

10

Troubleshooting Matrix

Error Code / SymptomRoot CauseExact Resolution
AttributeValueMustBeUniqueDuplicate proxyAddresses (SMTP) or UserPrincipalName between two accounts.Run IdFix tool on-prem to find and resolve duplicate SMTP aliases before syncing.
Password sync fails for specific user"User must change password at next logon" is checked in AD DS (PHS cannot sync temporary passwords).Clear checkbox in AD DS or enable temporary password sync feature flag.
Sync cycle takes hoursDatabase bloat or sync scheduler interval was manually changed.Verify scheduler runs every 30 minutes: Set-ADSyncScheduler -CustomizedSyncCycleInterval 00:30:00.

---

11

Production Best Practices

Production Best Practice

Always Deploy Password Hash Sync Even If Using PTA/ADFS:

Even if your organization mandates Pass-Through Authentication or Federation, enable Password Hash Synchronization as a secondary backup. This enables Microsoft Entra Identity Protection to detect leaked credentials matched against dark web databases.

---

12

MS-102 Exam Notes

Exam Blueprint & High-Yield Traps

High-Frequency Exam Objectives & Traps:

  1. Default Sync Interval: The default synchronization cycle interval is 30 minutes.
  2. Staging Mode Capability: A server in Staging Mode can be used to preview synchronization changes and acts as a hot standby; it never exports to Entra ID.
  3. Password Writeback: Password writeback allows users resetting passwords in cloud SSPR to write the new password back to on-prem Active Directory in real-time.

---

13

Official Documentation

PREVIOUS TOPIC1.3 Administrative Units (AU) & Cross-Tenant Access SettingsNEXT TOPIC2.2 Conditional Access: Zero Trust & Phishing-Resistant MFA