Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Understanding Azure AD Password (Hash) Sync

semperis.com | blog | #cloud | #authentication | #explainer | #azure-ad | #hybrid-identity | #password-hash-sync | #ad-connect

Summary

Password hash sync explained: AD Connect copies password hashes to Azure AD every two minutes for 'same sign-on'—simpler than federation and used by about half of syncing organizations.
Published
Collected

original ↗

Related coverage

blog · semperis.com
Azure AD Connect: the staging server
Explaining the little-noticed Azure AD Connect staging server option: why its sync database has no fault tolerance, and how a staging server mitigates the sync outages enterprise customers ask about.
blog · semperis.com
Securing Hybrid Identity
Covers hybrid identity risks—SolarWinds-style attacks pivot from on-prem AD into Azure AD—and recommends MFA plus AD Pass-through Authentication over legacy ADFS to shrink the attack surface.
blog · semperis.com
Hybrid Identity Protection with Dr. Nestori Synnimaa
AADInternals creator Dr. Nestori Synnimaa joins the HIP Podcast: every on-prem component in a hybrid AD configuration needs Tier 0 protection, and Azure AD sync compromise can expose credentials across both environments.
blog · semperis.com
Time to Leave ADFS Behind for Authenticating in Hybrid Environments?
Why it may be time to leave ADFS in hybrid environments: its complexity expands the attack surface, and SolarWinds showed an on-premises flaw can compromise the Azure AD tenant; Microsoft recommends migrating to Azure AD Application Proxy.
blog · semperis.com
Top Security Risks to Watch for in Shifting to Hybrid Identity Management
As enterprises integrate Microsoft Entra ID (formerly Azure AD) with on-prem AD, this piece examines hybrid identity risks—above all permission sprawl—and urges a look-before-you-leap approach to cloud identity adoption.
blog · semperis.com
Retake Control of Attribute Sync to Azure AD
Azure AD Connect syncs 151 attributes by default and they can't be fully removed later; Semperis' Darren Mar-Elia recommends app, attribute, domain and OU filtering to limit exposure in Azure AD.
back