mediumMultiple ChoiceObjective-mapped
MS-102 Practice Question: A company has an on-premises Active Directory…
A company has an on-premises Active Directory environment and wants to sync user identities to Microsoft Entra ID while avoiding storing password hashes in the cloud. The company wants to provide seamless single sign-on (SSO) for domain-joined devices. Which authentication method should be chosen?
⚠ Common exam trap
A common mix-up: candidates choose Password Hash Synchronization (PHS) because it is simpler and supports Seamless SSO, but they overlook the explicit requirement to avoid storing password hashes in the cloud, which PHS inherently does.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Pass-Through Authentication (PTA) with Seamless SSO
Pass-Through Authentication (PTA) with Seamless SSO is the correct choice because it validates user passwords directly against on-premises Active Directory without storing any password hashes in the cloud. Seamless SSO provides automatic sign-in for domain-joined devices using Kerberos delegation, meeting the requirement for a seamless SSO experience without password hash storage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Password Hash Synchronization (PHS)
Why it's wrong here
Password Hash Synchronization (PHS) is incorrect because it computes a one-way hash of each on-premises password and synchronizes that hash into Azure AD, meaning the cloud directory stores verifiable password hashes. This directly violates the stated requirement that password hashes must not be synchronized or stored in the cloud. While PHS is convenient for protecting against leaked credentials, it is precisely the authentication method the question seeks to avoid.
- ✓
Pass-Through Authentication (PTA) with Seamless SSO
Why this is correct
Pass-Through Authentication (PTA) with Seamless SSO is correct because PTA uses an on-premises connector agent to validate user passwords directly against Active Directory; the password hash is never persisted in Azure AD. Seamless SSO complements this by enabling domain-joined computers to authenticate transparently using Kerberos tickets, so users don't have to re-enter passwords. This meets both the sync requirement and the constraint of keeping password hashes on-premises.
- ✗
Federation with Active Directory Federation Services (AD FS)
Why it's wrong here
Federation with AD FS is inappropriate because, although AD FS itself validates credentials on-premises and issues claims without storing hashes in the cloud, the standard implementation for hybrid environments often enables Password Hash Synchronization as a fallback for Azure AD protection features, which reintroduces cloud-stored hashes. Additionally, AD FS adds significant infrastructure, certificate management, and proxy complexity without providing the native Seamless SSO experience that PTA offers. Thus, federation isn't a clean fit for the stated no-hash-in-cloud constraint.
- ✗
Cloud-only authentication
Why it's wrong here
Cloud-only authentication is wrong because it doesn't sync identities from on-premises Active Directory at all; Azure AD would have separate cloud accounts with passwords managed entirely in Azure AD. That fails the core requirement of syncing the on-premises environment, and it would store passwords/hashes in the cloud by definition, so it's the opposite of the intended design.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
SSO
Single Sign-On (SSO) is an authentication process that allows a user to access multiple applications or systems with one set of login credentials.
Key term
Pass-through authentication
Pass-through authentication is a Microsoft Azure Active Directory authentication method that validates user passwords directly against on-premises Active Directory without storing password hashes in the cloud.
About these practice questions
Courseiva writes every MS-102 question from scratch — 241 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.