mediumMultiple ChoiceObjective-mapped
Pass-through Authentication with Seamless SSO: When to Choose Over Password Hash Sync
An organization wants to allow users to sign in to Microsoft 365 using their on-premises Active Directory credentials but does not want to synchronize password hashes to the cloud. They also want to eliminate the need for users to re-enter their credentials when accessing cloud resources from domain-joined devices. Which combination of authentication methods should they implement?
Quick Answer
The correct combination is Pass-through Authentication with Seamless Single Sign-On. PTA validates user passwords directly against on-premises Active Directory without ever storing password hashes in the cloud, which directly satisfies the requirement to avoid hash synchronization. Seamless SSO then eliminates credential re-prompts on domain-joined devices by using Kerberos delegation to silently authenticate users against Microsoft Entra ID. On the MS-102 exam, this scenario tests your understanding of when to choose PTA over Password Hash Sync—specifically when security or compliance policies forbid cloud-stored hashes. A common trap is selecting Password Hash Sync with Seamless SSO, but that still synchronizes hashes, violating the core constraint. Remember the memory tip: “No hashes in the cloud? PTA is the proud choice; Seamless SSO makes the sign-in silent.”
⚠ Common exam trap
Many candidates confuse Seamless SSO as being exclusive to Password Hash Sync, but it is also fully supported with Pass-through Authentication, and the key differentiator is the requirement to avoid password hash synchronization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Pass-through Authentication (PTA) with Seamless Single Sign-On (SSO)
Pass-through Authentication (PTA) validates user passwords directly against on-premises Active Directory without storing password hashes in the cloud, satisfying the requirement to avoid hash synchronization. Seamless SSO eliminates the need for users to re-enter credentials on domain-joined devices by using Kerberos delegation to silently authenticate against Microsoft Entra ID, meeting both stated needs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Pass-through Authentication (PTA) with Seamless Single Sign-On (SSO)
Why this is correct
PTA validates passwords on-premises without storing hashes, and Seamless SSO provides automatic sign-in for domain-joined devices.
- ✗
Federation with Active Directory Federation Services (AD FS)
Why it's wrong here
Federation with AD FS is incorrect because while it prevents password hash synchronisation to Microsoft Entra ID and offers single sign-on for domain-joined devices, it introduces significant infrastructure complexity and ongoing management overhead. The scenario implies a desire for a solution that achieves the specified authentication goals without the operational burden of maintaining on-premises federation servers. It is tempting because AD FS precisely addresses the requirement of authenticating against on-premises Active Directory without syncing password hashes, and provides a robust single sign-on experience, making it a suitable choice for organizations with existing AD FS deployments or specific complex authentication requirements.
- ✗
Password Hash Sync (PHS) with Seamless SSO
Why it's wrong here
PHS synchronizes password hashes to the cloud, which the organization explicitly wants to avoid.
- ✗
Cloud-only authentication with MFA
Why it's wrong here
Cloud-only authentication does not use on-premises Active Directory credentials, so it does not meet the requirement.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
SSO
Single Sign-On (SSO) is an authentication process that allows a user to access multiple applications or systems with one set of login credentials.
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
About these practice questions
Courseiva writes every MS-102 question from scratch — 241 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MS-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An organization uses Microsoft Entra ID with Pass-through Authentication (PTA) and Seamless Single Sign-On (SSO). They notice that password changes in on-premises Active Directory are not reflecting immediately in Microsoft Entra ID for some users. What is the most likely cause?
hard- A.The PTA agents are overloaded
- ✓ B.The user's password change has not replicated to all domain controllers
- C.The Seamless SSO feature is disabled
- D.Microsoft Entra ID has a password hash sync delay
Why B: In a Pass-through Authentication environment, password changes are processed by on-premises Active Directory. The password change must replicate to all domain controllers before Microsoft Entra ID can authenticate the new password via the PTA agent. If replication is incomplete, the PTA agent may contact a domain controller that still has the old password, causing the delay.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.