Back to Checks
m365

Organization has password hash synchronization enabled for hybrid deployments

entra_password_hash_sync_enabled
Service: entraSeverity: medium
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined

Microsoft Entra hybrid tenants use password hash synchronization to replicate on-premises Active Directory password hashes to Entra for cloud authentication.

Applies to hybrid sync scenarios, not fully federated domains.

Prowler logoProwlerprowler-provider-m365

Risk

Without password hash synchronization, hybrid accounts lose leaked credential detection and cloud risk-based protections, weakening confidentiality. Authentication remains tied to on-prem services, reducing availability during outages. Users may reuse passwords across systems, increasing credential stuffing exposure.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks entra_password_hash_sync_enabled

Recommendation

Enable password hash synchronization for hybrid identities and keep it active even alongside federation as a resilient fallback. Combine with MFA, Conditional Access, and strong password policy enforcement for defense in depth. Apply least privilege and monitor sign-in risk to prevent account compromise.

Remediation

CLI

Set-ADSyncAADCompanyFeature -PasswordHashSync $true

Other

1Sign in to the on-premises server running Microsoft Entra (Azure AD) Connect
2Open Azure AD Connect and select Configure
3Choose Customize synchronization options and click Next
4Sign in with a Global Administrator account
5On Optional features, check Password hash synchronization
6Click Configure and wait for completion

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.entra.entra_client import entra_client


class entra_password_hash_sync_enabled(Check):
    """
    Check if password hash synchronization is enabled for hybrid Microsoft Entra deployments.

    This check verifies that password hash synchronization is enabled in hybrid Microsoft Entra deployments.
    Enabling password hash sync ensures that on-premises passwords are synchronized to Microsoft Entra,
    facilitating seamless authentication and enhancing leaked credential protection. Without password hash
    synchronization, users might have to manage multiple passwords and detection of leaked credentials would be compromised.

    Note: This control applies only to hybrid deployments using Microsoft Entra Connect sync and does not apply to federated domains.
    """

    def execute(self) -> List[CheckReportM365]:
        """
        Execute the password hash synchronization requirement check.

        Retrieves the organization settings from the Entra client and generates a report indicating whether
        password hash synchronization is enabled.

        Returns:
            List[CheckReportM365]: A list containing the report object with the result of the check.
        """
        findings = []
        for organization in entra_client.organizations:
            report = CheckReportM365(
                self.metadata(),
                resource=organization,
                resource_id=organization.id,
                resource_name=organization.name,
            )
            report.status = "FAIL"
            report.status_extended = "Password hash synchronization is not enabled for hybrid Microsoft Entra deployments."

            if organization.on_premises_sync_enabled:
                report.status = "PASS"
                report.status_extended = "Password hash synchronization is enabled for hybrid Microsoft Entra deployments."

            findings.append(report)
        return findings

References