EIDFED-007: Password Hash Sync Enabled Status
- Platform
- Entra ID / M365
- Category
- Entra ID Federation & Hybrid Identity
- Severity
- Medium
- Zero Trust pillar
- Identity (weight 3)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Password Hash Synchronization (PHS) replicates a hash of on-premises password hashes to Entra ID, enabling cloud authentication as a backup when federation or pass-through authentication is unavailable. While PHS provides resilience and enables leaked credential detection through Entra ID Identity Protection, organizations must understand the security implications of storing password derivatives in the cloud. PHS should be evaluated against organizational security requirements and risk tolerance.
Recommended value
PHS enabled as a backup authentication method with leaked credential detection active through Entra ID Identity Protection
Remediation
Check the Azure AD Connect configuration to determine if Password Hash Synchronization is enabled. If PHS is disabled, evaluate enabling it as a backup authentication method and to support Entra ID Identity Protection leaked credential detection. If PHS is already enabled, verify that Entra ID Identity Protection is configured to leverage the password hashes for risk-based detection of compromised credentials.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| no-data | Not Assessed |
Framework mappings
- NIST SP 800-53
- IA-5