Overview [Implement password hash synchronization with Microsoft Entra Connect Sync - Microsoft Entra ID | Microsoft Learn](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-password-hash-synchronization)
 
On prem password sync using AAD connect:  
[https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-selective-password-hash-synchronization#excluded-users-is-larger-than-included-users](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-selective-password-hash-synchronization#excluded-users-is-larger-than-included-users)
 
GSA guidance to move away from on prem to CBA [Certificate-Based Authentication on Microsoft Entra ID Guide (idmanagement.gov)](https://www.idmanagement.gov/implement/cba-azure/)
 
CISA guidance [Secure Cloud Business Applications (cisa.gov)](https://www.cisa.gov/sites/default/files/2024-03/Secure%20Cloud%20Business%20Applications%20-%20Hybrid%20Identity%20Solutions%20Guidance.pdf#page=25&zoom=100,0,0)

You must first enable PHS which includes all users, then implement selecting PHS configuration. Does that help to clarify?  
   
The second area which speaks more to the global PHS option is in the table of optional features here:  
[https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-install-custom#optional-features](https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.us%2Fv3%2F__https%3A%2F%2Flearn.microsoft.com%2Fen-us%2Fentra%2Fidentity%2Fhybrid%2Fconnect%2Fhow-to-connect-install-custom*optional-features__%3BIw!!BClRuOV5cvtbuNI!EdIhQ_2JnsMZZM15vDsR3UZMIYzaN7ulr_No9r0zXYGt0iRD3Q8zGYHhPk8K2k97Q9gwdjC0He11l_mXvb-5Tc7TbO5ldXLhFQ%24&data=05%7C02%7CMARCUS.A.GREGOIRE%40cbp.dhs.gov%7Ce976f01f04764dc9930808dc63bd67b1%7Ce4b16b844c564f279af730345a161ad4%7C0%7C0%7C638494912366138617%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=haOHFXlPS8bGBpL5%2BH9Ofv1vMLJkOw%2FA3Ml0lNJmW00%3D&reserved=0)  
 

|   |   |
|---|---|
|Password hash synchronization|If you selected federation as the sign-in solution, you can enable password hash synchronization. Then you can use it as a backup option.<br><br>  <br><br>If you selected pass-through authentication, you can enable this option to ensure support for legacy clients and to provide a backup.<br><br>  <br><br>For more information, see [Password hash synchronization](https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.us%2Fv3%2F__https%3A%2F%2Flearn.microsoft.com%2Fen-us%2Fentra%2Fidentity%2Fhybrid%2Fconnect%2Fhow-to-connect-password-hash-synchronization__%3B!!BClRuOV5cvtbuNI!EdIhQ_2JnsMZZM15vDsR3UZMIYzaN7ulr_No9r0zXYGt0iRD3Q8zGYHhPk8K2k97Q9gwdjC0He11l_mXvb-5Tc7TbO46W4S3pg%24&data=05%7C02%7CMARCUS.A.GREGOIRE%40cbp.dhs.gov%7Ce976f01f04764dc9930808dc63bd67b1%7Ce4b16b844c564f279af730345a161ad4%7C0%7C0%7C638494912366145779%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=Rw%2BMKNHfC4VmTvOY93gw7%2BYomK4nJ%2B9DcBeIVvhpRaw%3D&reserved=0).|
   

What happens to a user's cloud password after a user no longer fits the criteria for PHS? The answer to this is that the password that was last assigned remains active on the account.
 
The primary control to mitigate any risks associated with the user having a known cloud password at this stage would be enforcement of authentication methods using Conditional Access Authentication Strength (i.e. CBA). Use of the Password is denied in this scenario. Additionally, an administrator could reset the user's password again prior to removing them from scope of selective PHS. This would synchronize a password unknown to the user to the cloud and also reset their AD credential. The user at this point should be required to login with smart card to both AD and Entra, SCRIL and CA + Auth Strength respectively.  
   
Keep in mind that if you do need to use PHS as a temporary or fallback method (i.e. TAP is unavailable) then the process for managing this temporary credential would include adding the user to an exclusion group that toggles which CA policy and subsequently which auth methods apply. When the user is removed, they fall back to the baseline which would enforce PIV.