Introduction
Choosing the proper authentication method is crucial for organizations moving their application to Microsoft Cloud. It controls access to all cloud resources and data, enhances security, and improves user experience. A robust identity control plan safeguards cloud applications from unauthorized access.
In this article, I will guide you through the process of deploying Pass-Through Authentication and help you understand how your organization can benefit from this feature.
Authentication Method
Before proceeding with the deployment, let’s quickly discuss each authentication method supported by Microsoft Entra ID.
Microsoft Entra ID supports Cloud Authentication (Password Hash Synchronisation & Pass-Through Authentication) and Federated authentication.
What is Password hash synchronization?
Microsoft Entra ID allows on-premises directory objects to use the same username and password. Some premium features, like Identity Protection and Entra Domain Services, require password hash synchronization. Passwords are always securely stored in Microsoft Entra ID.
I’ve got you covered in one of my articles if you want to learn more about PHS!
What is Federated authentication?
Microsoft Entra ID delegates the authentication process to a trusted authentication system, like on-premises Active Directory Federation Services (AD FS), to verify the user’s password. This authentication system can also fulfill other advanced authentication requirements, such as third-party multifactor authentication.
I’ve written an article about the federation that you might find helpful.
What is Pass-through authentication?
The feature known as Pass-through Authentication is available at the tenant level and allows your users to sign into both on-premises and cloud-based applications using the same password. It provides seamless sign-on for domain-joined computers so that users don’t have to enter their credentials to access the Cloud-based application. Users’ credentials will be validated directly against the on-premise active directory.
How does Pass-Through Authentication work?
When users enter their username and password on the Office 365 sign-in page, Azure services or servers encrypt the password using a public key and then place the username and encrypted password on a queue for validation. One of the on-premise PTA agents registered on your on-premises initiates an outbound call from the corporate network to retrieve the username and encrypted password.
After that, the PTA agent decrypts the password using a private key that only it can access and tries to validate it against the on-premise Active Directory. The Domain controller will return the result (Success or Failure) to the PTA agent, who will forward it to the Entra ID.
Entra ID will determine the appropriate action based on the security features configured in your tenant. Once all are satisfied, the users will be allowed to sign in to the application.
What is Seamless Sign-On?
During the Pass-Through Authentication setup, the Entra Connect Sync wizard creates a COMPUTER ACCOUNT in On-Premise AD, representing your Entra ID Tenant.
When the user visits the Office 365 sign-in page on a domain-joined computer, Microsoft Entra ID requests a Kerberos ticket for the computer account. At this time, this domain-joined computer will receive a Kerberos ticket, which contains the user’s identity, and then it will be forwarded up to Entra ID.
Entra ID reviews the Kerberos ticket and determines what to do with it. Once all has been validated, it will allow the user to sign in silently. No password is required, and there is no need to join this domain-joined computer to Entra ID.
Prerequisites
Before proceeding with the Pass-through Authentication, it is important to make sure that all the necessary prerequisites have been met. Please cross-check the following list to ensure that all the prerequisites are in place before moving forward.
- Use the Hybrid Identity Administrator or Global Administrator account on your Microsoft Entra tenant.
- Custom domain name for your Microsoft Entra tenant.
- A Windows Server 2016 or newer is required. Windows Server Core versions are not supported.
- To achieve High Availability, please add more servers for installing Authentication Agents.
- To enhance security, please enable TLS 1.2 on the server.
- Please install the latest version of Microsoft Entra Connect software.
- Having at least three authentication agents installed on your tenant is recommended. A maximum of 40 agents can be installed.
- To establish a connection between servers and Microsoft Entra ID, it is necessary to allow ports 80, 8080, and 443.
- Allow *.msappproxy.net and *.servicebus.windows.net if you use the proxy.
- Allow access to the Azure datacenter IP ranges, updated weekly.
- Avoid using inline inspection or termination for outbound TLS communications between Azure Passthrough Agent and Azure Endpoint.
- If you have an outgoing HTTP proxy, ensure that autologon.microsoftazuread-sso.com is added to the allowed list.
- Ensure the following URLs are open in your firewall.
- login.windows.net
- login.microsoftonline.com
- For certificate validation, unblock the following URLs:
- crl3.digicert.com:80
- crl4.digicert.com:80
- ocsp.digicert.com:80
- http://www.d-trust.net:80
- root-c3-ca2-2009.ocsp.d-trust.net:80
- crl.microsoft.com:80
- oneocsp.microsoft.com:80
- ocsp.msocsp.com:80
Benefits for Organization
When it comes to organizational benefits, there are several advantages that businesses can enjoy. For example, users can use a single set of credentials to access both on-premise and cloud-based applications where their password won’t be stored in Entra ID in any form. More features and benefits are outlined below.
Users, including on-premise users, can manage their passwords using cloud-based self-service management tasks. There is no need for complex on-premises deployments or network configuration. Agent is lightweight in nature, which requires zero management, and it updates automatically. It works with Condition access policies and Multi-factor authentication.
PTA agent triggers only outbound connection from the on-premises network, so if you prefer to install on the DMZ network, then it is not supported. Multi-forest environments are supported, and this feature is free. You do not need any paid editions of Microsoft EntraID to use it.
The communication between the PTA agent and Entra ID is secured using certificate-based authentication, where these certificates are renewed automatically every few months by Microsoft Entra ID.
You can install additional PTA agents to achieve high availability. Smart Lockout protects your on-premises accounts against brute-force password attacks in the cloud.
Users can use popular web browsers such as Google Chrome, Firefox, and Opera, as well as Microsoft Office client applications that support modern authentication protocols. Users can sign in to Office 365 applications using their UserPrincipalName or Alternate ID attribute as the login credentials.
It does support Microsoft Entra Join and Hybrid Entra Joins for Windows 10 or later devices.
Limitation
Pass-through authentication has its limitations when it comes to detecting leaked credentials for user accounts. Also, it does not support the tenants that use Entra domain services, which requires Password hash synchronization to work. Moreover, it is not integrated with Microsoft Entra Connect Health.
Finally, if we were given a temporary or expired password to log into Entra Joined devices, then an attempt will fail. In this case, we must use a web browser to update our password through the Self-Service Password Reset feature.
Practical Example
In this scenario, my on-premise active directory, myforest2.com, is integrated with Entra ID tenant, M365BV206108.onmicrosoft.com, using the latest Microsoft Entra Connect software. Password-hash synchronization is enabled with a Single Sign-on. The figure below depicts the current hybrid architecture.
The following figure depicts the Password-Hash Synchronization feature that has been enabled on my tenant.
The following image shows a list of domains that have been registered on my Entra tenant.
The following figure showcases the password reset settings available on my Entra Tenant.
The Entra Connect configuration settings are depicted in the figures below.
The figure below illustrates the Entra ID connect Primary server settings.
The figure below illustrates the Entra ID connect Staging server settings.
Implementation Steps
Alright! Let’s get started to enable Pass-Through Authentication on my tenant.
Log in to the Entra Connect Sync primary server (EC101) and open the Azure AD Connect snap-in.
On the Additional task wizard page, select “ Change user sign-in and click Next.
Enter the hybrid Identity administrator credentials on the Connect to Azure AD page.
On the “User sign-in” wizard page, select Pass-through authentication. As you can see, the option “Enable Single-Sign is automatically ticked, and click Next.
On the “Enable single-sign-on” wizard page, enter the domain administrator credentials to use myforest2.com forest for single-sign-on.
On the Ready to Configure wizard page, Click Configure.
Now, on the Configuration Complete wizard, Click Exit.
To achieve High Availability, repeat the same steps on the Staging server, but make sure “Enable Stating mode” is enabled.
Now, we have successfully changed the sign-in method from PHS to PTA.
Verification
To verify this feature installed, you can go to the Entra ID admin page to verify the changes updated in the Entra ID tenant.
Also, you could verify the list of agents installed and their server details.
On the domain controller, make sure the computer object is created to reference the Entra ID.
To monitor the authentication status, you can add performance counters on a server running the PTA agent.
Conclusion
In conclusion, choosing the right authentication method is paramount when it comes to securing cloud resources and data. Microsoft Entra ID offers various authentication methods, including Password Hash Synchronization, Federated Authentication, and Pass-Through Authentication. Among these methods, Pass-Through Authentication stands out as it provides seamless sign-on for domain-joined computers and allows users to sign into both on-premises and cloud-based applications using the same password.
By following the proper steps outlined in this article, you can easily deploy Pass-Through Authentication so that organizations can benefit from increased security, improved user experience, and enhanced control over their cloud applications.
