Pass-through authentication (PTA) is the correct solution because it directly validates user credentials against the on-premises Active Directory in real time. This process inherently enforces all on-premises password policies, including complexity, account lockout, and password expiry, at the moment of sign-in. Additionally, PTA is fully compatible with Microsoft Entra Self-Service Password Reset (SSPR) when password writeback is enabled in Microsoft Entra Connect. This combination meets both of the specified requirements by leveraging the on-premises infrastructure for authentication policy enforcement while allowing users to manage their passwords from the cloud.

A. Microsoft Entra ID Protection: This is a security feature for detecting and responding to identity-based risks. It is not a primary user authentication method for a hybrid identity scenario.

B. Microsoft Entra Seamless Single Sign-On (Microsoft Entra Seamless SSO): This is a feature that improves the user sign-in experience on corporate devices. It works alongside either PTA or Password Hash Synchronization but is not the core authentication method itself.

D. password hash synchronization: This method authenticates users in the cloud using a synchronized hash of their on-premises password. It does not enforce on-premises policies like account lockout or logon hours in real time during authentication.

1. Microsoft Entra documentation

"What is Microsoft Entra Pass-through Authentication?"

Section: "Key benefits of using Microsoft Entra Pass-through Authentication": This section explicitly states

"User sign-in requests are validated directly against your on-premises Active Directory. As a result

you can enforce your on-premises password and account lockout policies." This directly supports the requirement to enforce on-premises policies.

2. Microsoft Entra documentation

"Choose the right authentication method for your Microsoft Entra hybrid identity solution"

Table: "Compare methods": The table shows that Pass-through Authentication "Enforces on-premises Active Directory account policies

such as account lockouts

password expiration

and permitted sign-in hours." In contrast

Password Hash Synchronization does not offer this real-time enforcement for sign-in.

3. Microsoft Entra documentation

"How does self-service password reset writeback work in Microsoft Entra ID?"

Section: "Supported operations": This document confirms that password writeback

a key component of SSPR for hybrid identities

is supported for users synchronized via Microsoft Entra Connect who are using Pass-through authentication or Password hash synchronization. This confirms PTA meets the SSPR requirement.