mediumMultiple Choice
Pass-through Authentication with Seamless SSO: When to Choose Over Password Hash Sync
An organization wants to allow users to sign in to Microsoft 365 using their on-premises Active Directory credentials but does not want to synchronize password hashes to the cloud. They also want to eliminate the need for users to re-enter their credentials when accessing cloud resources from domain-joined devices. Which combination of authentication methods should they implement?
Quick Answer
The correct combination is Pass-through Authentication with Seamless Single Sign-On. PTA validates user passwords directly against on-premises Active Directory without ever storing password hashes in the cloud, which directly satisfies the requirement to avoid hash synchronization. Seamless SSO then eliminates credential re-prompts on domain-joined devices by using Kerberos delegation to silently authenticate users against Microsoft Entra ID. On the MS-102 exam, this scenario tests your understanding of when to choose PTA over Password Hash Sync—specifically when security or compliance policies forbid cloud-stored hashes. A common trap is selecting Password Hash Sync with Seamless SSO, but that still synchronizes hashes, violating the core constraint. Remember the memory tip: “No hashes in the cloud? PTA is the proud choice; Seamless SSO makes the sign-in silent.”
⚠ Common exam trap
Many candidates confuse Seamless SSO as being exclusive to Password Hash Sync, but it is also fully supported with Pass-through Authentication, and the key differentiator is the requirement to avoid password hash synchronization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Pass-through Authentication (PTA) with Seamless Single Sign-On (SSO)
Pass-through Authentication (PTA) validates user passwords directly against on-premises Active Directory without storing password hashes in the cloud, satisfying the requirement to avoid hash synchronization. Seamless SSO eliminates the need for users to re-enter credentials on domain-joined devices by using Kerberos delegation to silently authenticate against Microsoft Entra ID, meeting both stated needs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Pass-through Authentication (PTA) with Seamless Single Sign-On (SSO)
Why this is correct
Pass-through Authentication validates credentials directly against on-premises Active Directory, so no password hashes reach Microsoft Entra ID. Seamless SSO then issues a desktop SSO token from the domain-joined device, removing repeated credential prompts for cloud resources.
- ✗
Federation with Active Directory Federation Services (AD FS)
Why it's wrong here
Federation with AD FS is incorrect because while it prevents password hash synchronisation to Microsoft Entra ID and offers single sign-on for domain-joined devices, it introduces significant infrastructure complexity and ongoing management overhead. The scenario implies a desire for a solution that achieves the specified authentication goals without the operational burden of maintaining on-premises federation servers. It is tempting because AD FS precisely addresses the requirement of authenticating against on-premises Active Directory without syncing password hashes, and provides a robust single sign-on experience, making it a suitable choice for organizations with existing AD FS deployments or specific complex authentication requirements.
- ✗
Password Hash Sync (PHS) with Seamless SSO
Why it's wrong here
Password hash synchronisation replicates password hashes to Microsoft Entra ID, directly contradicting the requirement not to synchronise them. It is chosen for its resilience and low overhead, but pass-through authentication with Seamless SSO is needed here.
- ✗
Cloud-only authentication with MFA
Why it's wrong here
Cloud-only authentication creates separate Microsoft Entra ID credentials, so users cannot sign in with their on-premises Active Directory accounts. It suits organisations with no directory dependency, but this scenario requires on-premises credential validation without synchronised hashes.
Go deeper
Related to this question
Learn chapter
Entra ID Entitlement Management and Access Packages
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
Key term
SSO
Single Sign-On (SSO) is an authentication process that allows a user to access multiple applications or systems with one set of login credentials.
About these practice questions
Courseiva writes every MS-102 question from scratch — 712 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MS-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An organization uses Microsoft Entra ID with Pass-through Authentication (PTA) and Seamless Single Sign-On (SSO). They notice that password changes in on-premises Active Directory are not reflecting immediately in Microsoft Entra ID for some users. What is the most likely cause?
hard- A.The PTA agents are overloaded
- ✓ B.The user's password change has not replicated to all domain controllers
- C.The Seamless SSO feature is disabled
- D.Microsoft Entra ID has a password hash sync delay
Why B: In a Pass-through Authentication environment, password changes are processed by on-premises Active Directory. The password change must replicate to all domain controllers before Microsoft Entra ID can authenticate the new password via the PTA agent. If replication is incomplete, the PTA agent may contact a domain controller that still has the old password, causing the delay.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.