When designing access to on-premises resources, choosing the right authentication method depends on security requirements and infrastructure complexity. Password Hash Synchronization (PHS) synchronizes a cryptographic hash of user passwords from on-premises Active Directory to Microsoft Entra ID, enabling authentication to occur entirely in the cloud. Conversely, Pass-through Authentication (PTA) relies on an on-premises PTA agent to validate credentials directly against your on-premises domain controller, keeping password validation local without storing hashes in the cloud. Active Directory Federation Services (AD FS) redirects authentication requests directly to on-premises federation servers, providing advanced sign-on controls but requiring the most complex on-premises infrastructure.
Azure AD Connect acts as the primary integration engine that synchronizes user accounts, groups, and credential states from on-premises environments to the cloud. This synchronization engine establishes a dependency where changes in the on-premises directory propagate up to Microsoft Entra ID. When implementing PHS, the synchronization process runs on a recurring cycle to update password hashes in the cloud database. PTA and AD FS bypass cloud-based credential storage during synchronization, acting instead as trust boundaries where Microsoft Entra ID hands off authentication verification to local systems.
Microsoft Entra Application Proxy publishes on-premises web applications to external users without opening inbound firewall ports or using a virtual private network (VPN). The request flow begins when an external user requests the application, which Microsoft Entra ID authenticates and passes through a secure cloud endpoint. The on-premises Application Proxy connector polls the cloud service for requests, retrieves them over an outbound connection, and forwards them to the internal web server. For organizations using existing security appliances, Microsoft Entra ID integrates with Secure Hybrid Access partners like F5 BIG-IP and Zscaler to extend cloud-based identity protections to legacy traffic. To achieve seamless single sign-on for legacy systems, the connector or partner appliance can use certificate-based Kerberos constrained delegation (KCD) to safely impersonate the authenticated user to local resources.
Conditional Access acts as the policy decision point that evaluates signals before granting access to published on-premises applications. These policies apply strict controls based on user identity, group membership, device compliance, and geographical location. If a user attempts to access an on-premises application through the Application Proxy, the system can enforce multifactor authentication (MFA) or block access from unmanaged devices. This creates a secure boundary where access is continuously evaluated, ensuring that only trusted users on compliant devices can reach internal corporate resources.
Venture into the world of Azure Infrastructure, where design meets functionality. Harness your skills and gain mastery over complex cloud structures to ace the AZ-305 Designing Microsoft Azure Infrastructure Solutions exam!
Prepare and test your skills
Prepare and test your skills
Password Hash Synchronization (PHS) synchronizes cryptographic hashes of user passwords to Microsoft Entra ID so authentication can occur entirely in the cloud. In contrast, Pass-through Authentication (PTA) validates credentials directly against on-premises domain controllers using an on-premises PTA agent, keeping validation local without storing hashes in the cloud.
Microsoft Entra Application Proxy receives and authenticates external user requests in Microsoft Entra ID through a secure cloud endpoint. An on-premises Application Proxy connector then retrieves those requests by polling the cloud service over an outbound connection and forwards them to the internal web server.
Conditional Access acts as a policy decision point that evaluates signals such as user identity, group membership, device compliance, and geographical location before granting access. Based on these evaluations, policies can require multifactor authentication (MFA) or block access entirely from unmanaged devices.
StudyCerts
StudyCerts