Pass-Through Authentication (PTA) is a Microsoft Entra hybrid authentication method that validates a user's password directly against on-premises Active Directory through agents.
Simple definition
Pass-Through Authentication (PTA) is a Microsoft Entra hybrid authentication method that validates a user's password directly against on-premises Active Directory through agents. It belongs to the Microsoft 365 / Entra / Intune vocabulary and is useful when reading architecture diagrams, product documentation, logs, or administration procedures.
What is it used for?
Its main purpose is to provide cloud authentication while validating the password against on-premises AD without relying on password-hash validation for that mode. The practical value depends on the surrounding architecture, security model, and operational requirements.
How does it work?
Entra places the encrypted request in a secure queue; an on-premises PTA agent retrieves it, validates credentials against AD, and returns the result.
Key points
- Scope: A Microsoft Entra hybrid authentication method that validates a user's password directly against on-premises Active Directory through agents.
- Operational goal: Provide cloud authentication while validating the password against on-premises AD without relying on password-hash validation for that mode.
- Implementation: Entra places the encrypted request in a secure queue; an on-premises PTA agent retrieves it, validates credentials against AD, and returns the result.
Points to watch
Deploy multiple agents for high availability and understand on-premises dependency before choosing PTA over Password Hash Sync.
In short
Pass-Through Authentication (PTA) = a Microsoft Entra hybrid authentication method that validates a user's password directly against on-premises Active Directory through agents. Use it when you need to provide cloud authentication while validating the password against on-premises AD without relying on password-hash validation for that mode.