Skip to main content
Version: 3.0.0-preview

CIS.M365.5.1.8.1 - (L1) Ensure that password hash sync is enabled for hybrid deployments

jeremy finney
Contributed by jeremy finneyAll contributors →

Overview​

5.1.8.1 (L1) Ensure that password hash sync is enabled for hybrid deployments

Password Hash Synchronization is one of the sign-in methods used to enable hybrid identity authentication. With this method, Microsoft Entra Connect synchronizes a cryptographically derived representation of a user's on-premises Active Directory password to Microsoft Entra ID.

The original NT password hash (MD4) is never transmitted to Entra ID. Instead, Entra Connect computes a SHA-256 hash of the original MD4 hash and synchronizes that value. Because only this secondary hash is stored in the cloud, the credential material in Entra ID cannot be reused for on-premises pass-the-hash attacks, even if compromised.

Note: This recommendation applies only to Microsoft 365 tenants operating in a hybrid identity configuration using Microsoft Entra Connect. It does not apply to federated or cloud-only deployments.

Rationale​

Password hash synchronization helps by reducing the number of passwords your users need to maintain to just one and enables leaked credential detection for your hybrid accounts. Leaked credential protection is leveraged through Entra ID Protection and is a subset of that feature which can help identify if an organization's user account passwords have appeared on the dark web or public spaces.

Using other options for your directory synchronization may be less resilient as Microsoft can still process sign-ins to 365 with Hash Sync even if a network connection to your on-premises environment is not available. This minimizes downtime and ensures business continuity.

Impact​

Compliance or regulatory restrictions may exist, depending on the organization's business sector, that preclude hashed versions of passwords from being securely transmitted to cloud data centers.

Remediation action​

To remediate using the on-premises Microsoft Entra Connect tool:

  1. Log in to the on-premises server that hosts the Microsoft Entra Connect tool.
  2. Double-click the Azure AD Connect icon that was created on the desktop.
  3. Click Configure.
  4. On the Additional tasks page, select Customize synchronization options and click Next.
  5. Enter the username and password for your global administrator.
  6. On the Connect your directories screen, click Next.
  7. On the Domain and OU filtering screen, click Next.
  8. On the Optional features screen, check Password hash synchronization and click Next.
  9. On the Ready to configure screen, click Configure.
  10. Once the configuration completes, click Exit.

Note: Microsoft Entra Connect sync is disabled by default. Password Hash Sync is Microsoft's recommended setting for new deployments.

Test Metadata​

FieldValue
Test IDCIS.M365.5.1.8.1
SeverityMedium
SuiteCIS
ProductEntra ID
FeatureHybrid identity
AreaAuthentication
Resource typeTenant
User impactLow
Implementation costLow
MITRE ATT&CKT1078.004 Cloud Accounts
Supports benchmarkCIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.1.8.1
Benchmark levelL1
Benchmark profilesE3 Level 1
Supports controlscis-m365:5.1.8.1, nist-800-53-r5:IA-5
PowerShell testTest-MtCisPasswordHashSyncEnabled
ServicesGraph

Source​