Check ID: entra_password_hash_sync_enabled
Provider: Microsoft 365
Service: entra
Severity: MEDIUM
Categories: identity-access, e3
Resource type: NotDefined

​
What this check verifies

Microsoft Entra hybrid tenants use password hash synchronization to replicate on-premises Active Directory password hashes to Entra for cloud authentication. Applies to hybrid sync scenarios, not fully federated domains.

​
Risk

Without password hash synchronization, hybrid accounts lose leaked credential detection and cloud risk-based protections, weakening confidentiality. Authentication remains tied to on-prem services, reducing availability during outages. Users may reuse passwords across systems, increasing credential stuffing exposure.

​
Recommendation

Enable password hash synchronization for hybrid identities and keep it active even alongside federation as a resilient fallback. Combine with MFA, Conditional Access, and strong password policy enforcement for defense in depth. Apply least privilege and monitor sign-in risk to prevent account compromise.

​
Remediation

Set-ADSyncAADCompanyFeature -PasswordHashSync $true

​
References

​
Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_password_hash_sync_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks