Detections
Analytics

5.1.8.1 (L1) Ensure that password hash sync is enabled for hybrid deployments

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Password hash synchronization is one of the sign-in methods used to accomplish hybrid identity synchronization. Microsoft Entra Connect synchronizes a hashed version of the user's password hash from an on-premises Active Directory to a cloud-based Entra ID instance.

 Note: The original MD4 hash isn't transmitted to Microsoft Entra ID. Instead, the SHA256 hash of the original MD4 hash is transmitted. As a result, if the hash stored in Microsoft Entra ID is obtained, it can't be used in an on-premises pass-the-hash attack.

Password hash synchronization helps by reducing the number of passwords your users need to maintain to just one and enables leaked credential detection for your hybrid accounts. Leaked credential protection is leveraged through Entra ID Protection and is a subset of that feature which can help identify if an organization's user account passwords have appeared on the dark web or public spaces.

Using other options for your directory synchronization may be less resilient as Microsoft can still process sign-ins to 365 with Hash Sync even if a network connection to your on-premises environment is not available. This minimizes downtime and ensures business continuity.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

To remediate using the on-prem Microsoft Entra Connect tool:

 - Log in to the on premises server that hosts the Microsoft Entra Connect tool
 - Double-click the Azure AD Connect icon that was created on the desktop
 - Click Configure.
 - On the Additional tasks page, select Customize synchronization options and click Next.
 - Enter the username and password for your global administrator.
 - On the Connect your directories screen, click Next.
 - On the Domain and OU filtering screen, click Next.
 - On the Optional features screen, check Password hash synchronization and click Next.
 - On the Ready to configure screen click Configure.
 - Once the configuration completes, click Exit.

Impact:

Compliance or regulatory restrictions may exist, depending on the organization's business sector, that preclude hashed versions of passwords from being securely transmitted to cloud data centers.

See Also

https://workbench.cisecurity.org/benchmarks/24619

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-2(1), 800-53|AC-3, CSCv7|16.4

Plugin: microsoft_azure

Control ID: e30cbd8a369526c1bc4b723a4cc53236c171940c98e1b9e273e18b50818077dc