Every previous post in this series has leaned on one idea without really unpacking it: identity. Zero Trust verifies identity. Defender for Identity protects identity. Conditional Access makes decisions based on identity. This unit finally stops and asks the obvious question — what actually is identity in Microsoft 365, and how does authentication prove it? Turns out there’s a lot more nuance here than “type your password.”
Two questions, one system
The unit frames everything around two simple questions:
- Identity — who is this person, device, or service trying to get in?
- Authentication — how do we prove they are who they say they are?
Every single interaction with Microsoft 365 — checking email, joining a Teams call, opening a file in SharePoint — starts by answering these two questions, and Microsoft Entra ID is the system doing the answering.
What identity actually is
An identity in Microsoft 365 is a digital representation of a user, device, or service. It’s made up of:
- A username (usually an email address)
- A password or other sign-in method
- Attributes — job title, department, group memberships
- Permissions — what that identity is actually allowed to do
Identities come in two flavours:
- Cloud-only — created and managed entirely in Entra ID, no on-premises dependency.
- Hybrid — originating from on-premises Active Directory, synced to Entra ID via Entra Connect Sync or Entra Cloud Sync.
The bit worth remembering: identity is the foundation. Once someone’s authenticated, Entra ID decides what they’re authorised to do based on roles, group memberships, and policy. Authentication answers “are you really you?” — authorisation (a separate step) answers “okay, now what are you allowed to do?”
Authentication: beyond the password
This is where the unit gets interesting. Passwords still work, but Microsoft 365 pushes hard toward passwordless, phishing-resistant methods:
- Microsoft Authenticator — push notifications or time-based codes, plus passwordless sign-in via fingerprint, face scan, or device PIN.
- FIDO2 security keys — physical USB or NFC keys using public-key cryptography. No password is ever transmitted, which makes them ideal for something like a public kiosk sign-in.
- Windows Hello — facial recognition, fingerprint, or device PIN. It’s technically MFA on its own, since it combines something you have (the device) with something you are (biometric data).
- Certificate-based authentication (CBA) — digital certificates on smart cards, common in government settings, verified via the certificate’s private key plus a PIN.
The features that reinforce authentication
- MFA — two or more verification factors. Password plus an Authenticator push, or biometric plus a prompt.
- Self-Service Password Reset (SSPR) — users reset their own password via a registered phone number or the Authenticator app, without calling the helpdesk.
- Microsoft Entra Identity Protection — machine learning flags risky sign-ins (unfamiliar location or device) and responds by blocking, challenging, or flagging for review.
Admins can also enforce policy: require MFA everywhere or just for high-risk scenarios, disallow passwords in favour of passwordless sign-in, and block legacy authentication protocols outright — legacy auth being a well-known weak point since it can’t support modern MFA challenges.
Hybrid authentication: three methods, one decision
This is the section I had to read twice, because the three hybrid authentication methods sound similar but work quite differently:
- Password Hash Synchronization (PHS) — a hash of the password (not the password itself) syncs from on-prem AD to Entra ID. Sign-in is validated entirely in the cloud, no on-premises server involved at sign-in time. It’s simple, resilient, and supports cloud-only features like Identity Protection — Microsoft’s default recommendation unless there’s a specific reason not to use it.
- Pass-through Authentication (PTA) — passwords are validated directly against on-premises AD in real time, via a secure agent. No password hash is ever stored in the cloud. This suits organisations with compliance requirements that prohibit storing password data in the cloud.
- Federation (e.g. AD FS) — authentication is delegated entirely to an external identity provider. The user gets redirected to an on-premises federation server, authenticates there, and comes back with a trusted token. This offers the most control (custom sign-in pages, advanced policies) but needs the most infrastructure, and Microsoft now generally recommends PHS or PTA instead, since they integrate better with Conditional Access and Identity Protection.
My way of remembering the difference: PHS trusts a copy of the credential in the cloud, PTA checks the real credential on-prem in real time, and Federation hands the whole job to someone else’s server entirely.
Single sign-on (SSO): sign in once, go everywhere
SSO means a user authenticates once with Entra ID and gets a reusable token, so they’re not re-prompted for every app — Outlook, Teams, SharePoint, OneDrive, and even non-Microsoft apps like Salesforce or ServiceNow, until the session expires or risk changes.
A few practical points that stood out:
- SSO works in both cloud-only and hybrid setups — in hybrid, signing into a domain-joined workstation flows straight through to cloud services.
- On Windows devices joined to Entra ID or hybrid-joined to on-prem AD, SSO is enabled by default via Windows Integrated Authentication.
- On iOS/macOS with Intune, SSO extensions let users sign into enterprise apps automatically.
- The real security win isn’t just convenience — fewer sign-in prompts means less password reuse and less exposure to phishing. Combine SSO with Conditional Access and MFA, and you get a genuinely strong, low-friction identity experience.
My takeaway
What ties this whole unit together is a layering effect: identity establishes who, authentication proves that they are who they say, and SSO makes proving it once enough for everything else — while Conditional Access and Identity Protection keep watching in the background in case anything changes. It’s the same Zero Trust “verify explicitly” principle from earlier posts, just zoomed all the way into the mechanics.
Practice quiz: identity and authentication
Q1. Which two questions does identity and authentication in Microsoft 365 fundamentally answer?
- A) What data is stored, and where is it stored?
- B) Who is trying to access resources, and how do we prove they are who they say they are?
- C) Which device is compliant, and which app is sanctioned?
- D) What is the user’s risk score, and what is their location?
Q2. Which system manages digital identities and verifies users across Microsoft 365?
- A) Microsoft Purview
- B) Microsoft Entra ID
- C) Microsoft Sentinel
- D) Microsoft Defender for Cloud Apps
Q3. What is the difference between a cloud-only identity and a hybrid identity?
- A) Cloud-only identities support MFA; hybrid identities do not
- B) Cloud-only identities are created entirely in Entra ID; hybrid identities originate on-premises and sync to Entra ID
- C) Hybrid identities cannot use SSO
- D) There is no functional difference
Q4. A user authenticates on a public kiosk using a physical USB key, with no password ever entered or transmitted. Which method is this?
- A) Windows Hello
- B) FIDO2 security key
- C) Certificate-based authentication
- D) Password Hash Synchronization
Q5. Why is Windows Hello considered a form of MFA on its own?
- A) It requires a password in addition to a PIN
- B) It combines something the user has (the device) with something the user is (biometric data)
- C) It requires both a smart card and a certificate
- D) It always requires a second physical security key
Q6. An employee forgets their password and resets it themselves using a code sent to their registered phone, without contacting the helpdesk. Which feature is this?
- A) Self-Service Password Reset (SSPR)
- B) Federation authentication
- C) Pass-through Authentication
- D) Certificate-based authentication
Q7. In a hybrid environment, which authentication method validates credentials entirely in the cloud using a synced password hash, with no on-premises server involved at sign-in time?
- A) Federation authentication
- B) Pass-through Authentication (PTA)
- C) Password Hash Synchronization (PHS)
- D) Certificate-based authentication
Q8. An organisation has a compliance requirement that prohibits storing any form of password data in the cloud. Which hybrid authentication method fits this requirement?
- A) Password Hash Synchronization (PHS)
- B) Pass-through Authentication (PTA)
- C) Federation authentication
- D) FIDO2 security keys
Q9. Which hybrid authentication method delegates sign-in entirely to an external identity provider like AD FS, redirecting users to an on-premises server?
- A) Password Hash Synchronization
- B) Pass-through Authentication
- C) Federation authentication
- D) Windows Hello
Q10. Why does Microsoft generally recommend PHS or PTA over Federation for most organisations today?
- A) Because Federation cannot support MFA at all
- B) Because PHS and PTA are simpler, more resilient, and integrate better with cloud-only features like Conditional Access and Identity Protection
- C) Because Federation is being fully deprecated in 2026
- D) Because PHS and PTA don’t require Entra Connect
Q11. What is the primary security benefit of single sign-on (SSO), beyond user convenience?
- A) It eliminates the need for MFA entirely
- B) It reduces password-related risk, since users authenticate less often and are less likely to reuse weak passwords or fall for phishing
- C) It replaces the need for Conditional Access
- D) It removes the need for identity governance
Q12. On a Windows device that is Entra ID-joined or hybrid-joined to on-premises AD, how is SSO typically enabled?
- A) Manually, through a separate SSO extension the user must install
- B) By default, through Windows Integrated Authentication
- C) Only after configuring Federation authentication
- D) SSO is not supported on Windows devices
Answers
- B — Identity asks “who is this,” authentication asks “how do we prove it.” Everything else in Microsoft 365 access control builds on these two questions.
- B — Microsoft Entra ID is the cloud-based identity and access management system underpinning all of Microsoft 365.
- B — Cloud-only identities live entirely in Entra ID; hybrid identities originate in on-premises AD and sync via Entra Connect Sync or Entra Cloud Sync.
- B — FIDO2 keys use public-key cryptography for passwordless authentication, ideal for scenarios like shared or public devices.
- B — Windows Hello ties something you have (the device) to something you are (biometric data), which is the definition of a multi-factor combination.
- A — SSPR lets users self-serve a password reset using a pre-registered verification method, cutting helpdesk load.
- C — PHS syncs a password hash to the cloud, so sign-in validation happens entirely in Entra ID with no on-premises involvement at that moment.
- B — PTA never stores password hashes in the cloud; it validates credentials against on-premises AD in real time via a secure agent, fitting strict compliance requirements.
- C — Federation redirects users to an external identity provider like AD FS, which authenticates them and issues a trusted token back to Entra ID.
- B — Both are simpler to maintain than Federation and integrate more smoothly with Conditional Access and Identity Protection, which is why Microsoft now favours them for most organisations.
- B — Fewer repeated sign-in prompts means less password fatigue, reuse, and phishing exposure — a real security gain, not just a UX one.
- B — Windows Integrated Authentication enables SSO by default on Entra ID-joined or hybrid-joined Windows devices, no extra configuration needed.
That’s it for this one — wait until the next post!
