Disable NTLM, TLS v1 and secure your Azure AD DS managed domain

You can secure your Azure AD DS managed domain by disabling NTLM v1 support, TLS v1, and synchronization of NTLM password hashes from the on-premises Active Directory instance.
Source: Microsoft Azure – aggiornamenti