Your network contains an on-premises Active Directory domain that sync to an Azure Active Directory...

The exhibit shows Pass-through authentication (PTA) enabled with two agents and Password Hash Sync (PHS) enabled. SC-300 materials state that when both PTA and PHS are enabled, Azure AD can fall back to password hash verification if PTA agents are unavailable. With connectivity from on-premises to the Internet lost, PTA agents cannot validate passwords; however, PHS continues to allow cloud authentication for synchronized users. Therefore:

• User1 (cloud-only) authenticates in Azure AD directly, unaffected by on-prem connectivity.

• User2 (directory-synced) can still sign in because PHS is enabled and provides backup authentication when PTA is unreachable.

• User3 (guest) authenticates in the home tenant, which is independent of your on-prem connectivity; the host tenant simply relies on the external identity.

SC-300 explicitly teaches that enabling PHS alongside PTA provides resiliency for sign-in and is a recommended best practice. Consequently, all three users can sign in under the described outage.