Should I use Password Hash Sync or Pass-Through Authentication?

Password Hash Sync (PHS) for almost everyone. It has no on-premises dependency at sign-in time, supports Identity Protection's leaked-credential detection, and can act as a resilient fallback even alongside federation. Pass-Through Authentication (PTA) is for the specific case where regulatory or internal policy forbids storing password hashes in the cloud — accept that an on-premises outage then also stops cloud sign-in, since PTA authenticates against on-prem AD through an agent.

Why PHS is the default

• No agent dependency and no on-premises outage risk at sign-in time.
• Feeds Identity Protection's leaked-credential detection, which compares synced hashes against known-breached credential lists.
• Simpler to operate than PTA's agent fleet or federation's AD FS farm.

When PTA is the right call instead

• A specific regulatory or internal security policy prohibits password hashes leaving the on-premises environment.
• Accept the trade-off knowingly: an on-premises outage or agent failure blocks cloud sign-in too.

Federation (AD FS)

Treated as the legacy option to migrate away from unless a specific, current requirement still depends on it — it is heavier to operate than either PHS or PTA.