PHS vs PTA vs Federation
When you connect on-premises Active Directory to Microsoft Entra ID, you must choose how users authenticate. The decision affects resilience, security features, and operational burden for years. Here's how the three options compare.
Password Hash Sync (PHS)
Cloud authentication, minimal dependencies.
Best for almost every organization — the recommended default.
Strengths
- No on-prem infrastructure required to sign in
- Survives on-prem outages — authentication stays up
- Enables leaked-credential detection and Identity Protection
- Simplest to operate and the easiest to make highly available
Trade-offs
- A hash of a hash is synced to the cloud (still secure, but some policies object)
- Password changes take a few minutes to sync
Pass-through Authentication (PTA)
Validate passwords on-prem, in real time.
Best when policy forbids any password material in the cloud.
Strengths
- Passwords are validated against on-prem AD directly
- No password hashes stored in the cloud
- Immediate enforcement of on-prem account states
Trade-offs
- Requires highly-available connector agents on-prem
- Sign-in depends on on-prem availability and connectivity
- More moving parts to monitor and patch
Federation (ADFS)
External token service handles authentication.
Best only for specific legacy needs — and a candidate for retirement.
Strengths
- Supports niche requirements (smart cards, custom claims rules)
- Familiar to organizations with an existing ADFS investment
Trade-offs
- Internet-facing attack surface and high operational cost
- Sign-in fails if the federation farm is down
- Microsoft recommends migrating to cloud authentication
The verdict
For the vast majority of organizations, Password Hash Sync (with Seamless SSO) is the right choice — it's the most resilient, unlocks cloud security features, and is the simplest to run. Choose PTA only when policy genuinely forbids password material in the cloud, and treat Federation as something to migrate away from unless a specific requirement demands it.
Common questions
Yes. Moving from Federation to PHS or PTA is a well-trodden path and can be staged with a pilot group. PHS is also a recommended fallback to enable even if you primarily use another method.
Ready to secure your identity foundation?
Book a free 30-minute discovery call. We'll talk through your environment and where the biggest wins are — no obligation.