'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Enable Pass-Through Authentication in Microsoft Entra Connect
Question details
User needs to troubleshoot and enable Pass-Through Authentication (PTA) in Microsoft Entra Connect when it shows as disabled despite authentication agents being active.
- Product
- Microsoft Entra Connect
- Device & OS
- not provided
- Scenario
- Configuring identity and sign-on settings in a Microsoft Entra ID hybrid environment.
- Observed behavior
- Seamless Single Sign-On is shown as enabled, but Pass-Through Authentication is disabled, even though the installed authentication agents are active and healthy.
Ensure you have Global Administrator privileges in your Microsoft Entra ID tenant and Enterprise Administrator rights in your local Active Directory to modify authentication configurations.
Validate Authentication Agent Requirements and Connectivity
Verify that your on-premises authentication agents can communicate properly with Microsoft Entra ID datacenters, as connectivity issues can prevent PTA from fully enabling.
Pass-through Authentication relies on lightweight agents installed on your on-premises Windows servers. If these agents lack the necessary outbound port access or domain privileges, the Entra Connect wizard may fail to enable PTA even if SSO succeeds.
Sign in to the Microsoft Entra admin center, browse to 'Identity' > 'Hybrid management' > 'Microsoft Entra Connect' > 'Connect Sync', and click on 'Pass-through Authentication' to verify all agents are listed as 'Active'.
Ensure your firewall allows outbound traffic on port 443 from the servers hosting the agents to Microsoft Entra datacenter IP addresses.
Open the Event Viewer on your agent server and navigate to 'Application and Services Logs' > 'Microsoft' > 'AzureAdConnect' > 'AuthenticationAgent' > 'Admin' to identify specific connectivity or authentication errors.
Reconfigure User Sign-in via Microsoft Entra Connect
Rerun the Entra Connect wizard to explicitly toggle the primary authentication method to Pass-Through Authentication and force the configuration update.
Consult Microsoft Q&A for Complex Active Directory Issues
Post your specific configuration environment to the Microsoft Q&A Active Directory community if automated configurations continuously fail.
Streamline Your Organization's Workflow with WPS Office
While managing complex identity infrastructure like Microsoft Entra Connect and Active Directory, you also need reliable desktop tools for your workforce. WPS Office offers a completely free, highly compatible, and easy-to-deploy alternative to Microsoft Office, reducing software overhead while maintaining enterprise-level productivity.
- 1. Download the Installer: Visit the official WPS Office website to download the free installer for personal or enterprise deployment.
- 2. Deploy to Endpoints: Use your standard IT management tools, such as Active Directory Group Policy, to distribute the lightweight software to your users.
- 3. Begin Working Immediately: Open existing Microsoft Office documents in WPS Office and experience seamless compatibility without needing additional licenses.
Frequently Asked Questions
Why does Entra Connect show Seamless SSO as enabled but Pass-Through Authentication as disabled?
This partial deployment typically happens if the PTA enablement process fails while running the Entra Connect wizard. Common reasons include blocked outbound ports (such as 443), proxy server interference, missing Enterprise Admin privileges in AD, or authentication agent installation failures, leaving SSO active but the main PTA service incomplete.
What network ports must be open for Pass-through Authentication agents?
The authentication agents require outbound connectivity over port 443 to reach specific Microsoft Entra endpoints. No inbound network ports need to be opened on your corporate firewall for PTA to function.
Can I use Password Hash Synchronization as a fallback for Pass-through Authentication?
Yes. While Entra Connect only allows you to select one primary sign-in method, you can selectively enable Password Hash Synchronization (PHS) alongside Pass-through Authentication. PHS can act as a fallback if your on-premises agents become unreachable and also enables features like leaked credential detection.
