MS-102 Practice Question: Implement and manage Microsoft Entra identity and access
You are planning a migration from on-premises Active Directory to Microsoft Entra ID using cloud sync. You need to synchronize user passwords so that users can authenticate using their existing passwords. Which feature should you enable?
⚠ Common exam trap
Candidates often confuse Pass-Through Authentication with password synchronization, but PTA does not synchronize hashes—it only validates passwords in real time against on-premises AD, which is not the same as synchronizing passwords for cloud sync.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Password Hash Synchronization
Password Hash Synchronization (PHS) is the correct feature because it synchronizes the hash of a user's on-premises Active Directory password to Microsoft Entra ID, allowing users to authenticate with the same password without any additional on-premises infrastructure. Cloud sync specifically relies on PHS to replicate password hashes from AD to Entra ID, enabling seamless authentication for cloud-based services.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Pass-through Authentication
Why it's wrong here
Pass-through Authentication (PTA) validates user passwords directly against on-premises Active Directory at sign-in time, but it never synchronizes password hashes to Microsoft Entra ID. Therefore, even though PTA provides a seamless cloud authentication experience, it does not meet a requirement to sync password hashes for cloud-based validation, and it also forces Microsoft Entra ID to depend on the on-premises DC for every authentication attempt.
- ✓
Password Hash Synchronization
Why this is correct
Password Hash Synchronization (PHS) synchronizes a hash of the on-premises Active Directory password to Microsoft Entra ID, enabling users to sign in to Microsoft 365 and Microsoft Entra ID with the same password without any on-premises infrastructure at the moment of authentication. PHS also supports advanced security features like leaked credential detection and Identity Protection, making it the correct choice when the goal is to have password hashes available in the cloud.
- ✗
Federation with AD FS
Why it's wrong here
Federation with AD FS does not sync password hashes; instead, it redirects Microsoft Entra ID authentication requests to the on-premises AD FS farm, where the password is validated against the local domain controller. This creates an extra dependency on the on-premises farm and storage of password hashes in the cloud is avoided, so it is not the right option if the requirement explicitly asks for password hashes to be synchronized for cloud authentication.
- ✗
Seamless Single Sign-On
Why it's wrong here
Seamless Single Sign-On (Seamless SSO) is not a standalone authentication method; it is a feature that silently signs users in to Microsoft Entra ID when they are on a domain-joined device, but it must be combined with either PHS or PTA. It does not synchronize or store any password hashes in the cloud, so it cannot satisfy a requirement to sync password hashes for authentication.
Go deeper
Related to this question
Learn chapter
Microsoft Entra Verified ID
Key term
Cloud sync
Cloud sync is the process of automatically keeping data files or configurations consistent between a local device and a remote cloud storage service by synchronizing changes made on either side.
Key term
Password hash synchronization
Password hash synchronization is a Microsoft Microsoft Entra Connect feature that synchronizes a hash of a user's on-premises Active Directory password to Microsoft Entra ID, enabling cloud-based authentication without additional infrastructure.
About these practice questions
Courseiva writes every MS-102 question from scratch — 712 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.