Now,
how are we synchronizing or replicating user passwords from local AD into
Azure AD? The most common perhaps is password hash synchronization. Now please
understand that Azure AD Connect service does not take your local password
hashes and replicate those into the cloud.
That presents a security issue, doesn't it?
Because you've probably heard of rainbow tables attacks against password hashes.
Now, so what the Azure AD Connect engine does, it computes a cryptographic hash
of the local hash and stores that in the cloud.
Now the advantage of password hash sync is that it's easy to set up, and your
users can sign into cloud apps, even when they're away from your corporate
network because the full credential, including the password, is in Azure AD.
Now passthrough authentication is for businesses whose security requirements
are such that you don't want to store any kind of local hash or even a hash of
a hash in the cloud.
In this case, users cannot sign into cloud apps unless their VPNned into
corp net or are on your corp net because you have a reliance or a
dependency on the passthrough authentication agent.
So there's an additional dependency that you need on your local
infrastructure servers that handles those authentication requests and
allows you to overcome that issue of not having a password stored in
Azure AD. You might think then, then why in the world would you want to
do passthrough authentication?
Well, like I said,
it's mainly for businesses that have security requirements to
where all password management and password presence has to be
controlled on‑prem and not in the cloud.
Another idea where the password is not in the cloud,
but authentication is handled completely locally is the federation option.
Azure AD Connect works seamlessly with Active Directory Federation
Services, so you can set up a federation trust relationship between
your local Active Directory environment and Azure AD. And when the user
attempts to sign into a cloud app,
they're redirected to your AD FS farm where they're authenticated locally,
a token is generated, and the user is lead in.
Now the exam doesn't get into federation.
It's mainly password hash synchronization with perhaps a sprinkle of passthrough thrown in.