What this check looks at
For a tenant synchronised from an on-premises Active Directory, checks that password hash synchronisation is on and running, from when Microsoft last received a password sync.
In a hybrid organisation, Microsoft Entra Connect Sync or Entra Cloud Sync copies accounts from on-premises Active Directory to Microsoft Entra ID. Password hash synchronisation is an optional part of it: it copies a hash of each password’s hash, never the password itself, so Entra ID can check sign-ins and passwords on its own.
This check applies to tenants with directory synchronisation enabled and reads, from the tenant’s organisation profile, when Microsoft last received a password hash sync. It fails when there has never been one (the feature is off), warns when the last one was more than seven days ago, and passes otherwise. A cloud-only tenant is not applicable.
Organisations often leave it off because sign-in goes through pass-through authentication or AD FS. It can be on alongside either, as a backup and for leaked-credential detection, without changing how people sign in.
Why it matters
Without password hash sync, Entra ID cannot spot passwords found in leaked-credential lists, and if the on-premises servers go down (ransomware, a failed domain controller) nobody can sign in to Microsoft 365 until they are back. With it, the business keeps working from the cloud and leaked passwords raise a user risk.
At a 60-person accountancy, ransomware encrypted the two domain controllers on a Monday morning. Sign-in to Microsoft 365 went through pass-through authentication, so with the agents down nobody could open email or Teams to tell clients what had happened. Password hash sync had never been turned on, so there was nothing to switch sign-in to; staff were locked out for four days while the servers were rebuilt.
The same hashes let Entra ID Protection flag an account whose password turns up in a breach, raising its user risk so a Conditional Access policy can ask for a password change. That needs Entra ID P2 to act on, but the hashes have to be there first.
CIS Microsoft 365 Foundations Benchmark v7.0.0 recommendation 5.1.8.1 asks for it in hybrid deployments. ISO 27001 A.5.17 (authentication information) and the NCSC CAF identity and access control outcome cover protecting and checking credentials.
How to fix it
Where: Entra admin centre → Identity → Hybrid management → Microsoft Entra Connect
Before you start
- Check which sign-in method the tenant uses (password hash sync, pass-through or federation): hash sync can be on as a backup whichever it is.
Step by step
- Check the current setting. In the Microsoft Entra admin centre, go to Identity > Hybrid management > Microsoft Entra Connect > Connect Sync. Under the sync status, Password Hash Sync shows Enabled or Disabled.
- Turn it on in Entra Connect. On the Entra Connect server, open Microsoft Entra Connect, choose Configure, then Customize synchronization options. Go through to Optional features, tick Password hash synchronization, and finish the wizard. For Cloud Sync, edit the configuration and tick Password hash sync.
- Keep the sign-in method as it is. Turning on hash sync does not change sign-in: pass-through authentication or federation carry on as before. Switching sign-in to the cloud is a separate decision, kept for when on-premises is unavailable.
- Confirm it ran. After the next sync cycle, Connect Sync shows Password Hash Sync enabled with a recent time. The finding clears at the next assessment.
What users will notice
None: sign-in does not change. A hash of each password’s hash is copied to Entra ID, so leaked passwords can be spotted and sign-in works if on-premises servers are down.
How to confirm it worked
Entra admin centre → Identity → Hybrid management → Microsoft Entra Connect shows Password Hash Sync enabled, and the next assessment shows it ran today.
Frameworks and controls
This check maps to controls in 11 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.a Identity verification, authentication and authorisation |
| DSPT | Standard 4: Managing data access |
| Microsoft Cloud Security Benchmark | IM-1 Use centralised identity and authentication system |
| Zero Trust | Identities |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| NIST SP 800-171 | 3.5.2 Authenticate users, processes and devices |
| CMMC Level 2 | IA.L2-3.5.2 Authentication |
| ISO 27001:2022 | A.5.17 Authentication information |
| CIS M365 | 5.1.8.1 Ensure that password hash sync is enabled for hybrid deployments |
| NIST CSF 2.0 | PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization |
| NCSC 10 Steps | Identity and access management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Implement password hash synchronization (Microsoft Learn)