AZ-305 Design infrastructure solutions Practice Question
Your organization has a hybrid identity solution using Microsoft Entra ID (formerly Azure AD) and on-premises Active Directory. You need to design a solution that allows users to use their on-premises credentials to authenticate to cloud applications, but you want to avoid synchronizing password hashes to the cloud. Which authentication method should you choose?
⚠ Common exam trap
Many candidates confuse Seamless SSO as an independent authentication method, when it is actually a convenience feature that must be paired with either PTA or PHS, and they may overlook the explicit requirement to avoid password hash synchronization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Pass-through Authentication
Pass-through Authentication (PTA) is the correct choice because it validates users' passwords directly against on-premises Active Directory without ever storing password hashes in the cloud. This meets the requirement to avoid synchronizing password hashes while still enabling authentication to cloud applications via Microsoft Entra ID.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Seamless Single Sign-On
Why it's wrong here
Seamless Single Sign-On is not a standalone authentication method; it is a feature that silently supplements either Pass-through Authentication or Password Hash Synchronization. It works by leveraging a Kerberos ticket obtained from the on-premises Active Directory domain by a specially created computer account (AzureADSSOAcc) in Microsoft Entra ID, then presenting it for sign-in. However, the actual password validation still falls to the underlying method, so it cannot by itself avoid synchronizing password hashes; in fact, if paired with Password Hash Synchronization, it would still require hash sync. Therefore, it fails the requirement for an independent mechanism that keeps password hashes out of the cloud.
- ✓
Pass-through Authentication
Why this is correct
Pass-through Authentication is correct because it validates the user's password directly against the on-premises Active Directory without ever storing a password hash in Microsoft Entra ID. An agent on the on-premises server listens via an outbound connection to the Microsoft Entra ID Service Bus; when a sign-in occurs, the cloud sends the credentials to the agent, which checks them against AD and returns a success or failure result. This design meets the explicit requirement to avoid synchronizing password hashes, while still allowing Microsoft Entra ID and Microsoft 365 to authenticate users with their existing on-premises credentials.
- ✗
Active Directory Federation Services (AD FS)
Why it's wrong here
AD FS is tempting as it facilitates federated identity, allowing users to authenticate to cloud applications using on-premises credentials. However, it fails this specific scenario because AD FS relies on issuing security tokens, which still requires a mechanism for the user's on-premises identity to be verified by the federation service, and it doesn't directly fulfil the requirement of avoiding password hash synchronisation by itself in this context.
- ✗
Password Hash Synchronization
Why it's wrong here
Password Hash Synchronization is wrong for this scenario because it specifically copies a verifiable hash of the password into Microsoft Entra ID. The process reads the password hash from on-premises AD, applies a per-user salt and a pre-computation key, and stores the final hash in Microsoft Entra ID, enabling cloud-side authentication without contacting the on-premises environment. Although this is highly convenient and resilient, it directly violates the stated desire to avoid synchronizing password hashes to the cloud, making it the opposite of the correct answer.
Go deeper
Related to this question
About these practice questions
This AZ-305 question is part of Courseiva's 795-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.