password hash sync or passthrough sync with sso

[SchylgeICT]

Dear reader,

I'm planning for migrating our env. We will go to a hybrid env. The question i have is about adconnect and the different choices. With password has sync a copy of th eusers password will be maintained in ad. I can understand that when a users is at home at a non domain joined machine he/she will be able to logon to o365. But what happens when you choose passthruoghr sync? A password at azure will not be available, will the same user be able to logon to o365 at a non domain joined machine at home? If he/she can, where does authentication take place? If auth happens on the local ad through adconnect, then what will happen if the local ad is unreachable because of a poweroutage or somthing?

Thanks in advance,

best regards Ruud  Boersma

[#2 · Accepted solution]

They will not be able to authenticate. For this reason, it's recommended to configure Password-hash sync as a fallback option, but that process is not automatic, so have that in mind. 

[#3]

As Vasil said if it’s down they cannot login. Basically you get an agent of sorts that azuread connects back to do the auth onprem.

As for users at home it will work fine long as your onprem AD is online as the auth will pass through to your ad servers basically.