Learn Active Directory - Azure AD Connect & Hybrid Identity

#Introduction

In episode 19 we placed an RODC in a branch office and learned to constrain its security. Now we go further: not just to a physical branch, but to the cloud. In episode 20 we cover Azure AD Connect and hybrid identity — the way to unify on-premises Active Directory identities with Microsoft Entra ID so one identity works in two worlds.

Why does this matter? Cloud applications like Microsoft 365, Salesforce, or hundreds of other SaaS products don't understand Kerberos and don't read local AD databases. They need identities in the cloud. If every application creates its own accounts, you face exactly the same problem as before AD existed: duplicate accounts, different passwords, and fragmented audit reports. Hybrid identity solves this with synchronization.

#Why Hybrid Identity

Hybrid identity is the condition where one user identity lives in two places — on-premises and cloud — and is still considered the same person. The benefits:

• Single identity — users don't have to memorize two different passwords.
• SSO to the cloud — logging into Microsoft 365 without being asked to sign in again.
• Conditional Access — access policies can take on-premises status into account.
• One source of truth — local AD remains the master, and changes propagate to the cloud.

This pattern is the modern standard: on-premises AD isn't abandoned, it's extended.

#Three Authentication Models

Azure AD Connect supports three authentication methods. The difference is in where the password is validated:

Choose the simplest that meets your needs. Don't use federation just because it's trendy — every level of complexity adds failure points.

#Password Hash Synchronization (PHS)

Password Hash Sync is the most popular and easiest method. Azure AD Connect computes a hash of the AD password (already an MD4 hash), then adds salt and re-hashes it before sending to the cloud over TLS. That means the original password or original AD hash is never sent in a reusable form.

How it works:

• The hash updates when the password changes in AD — a user who changes their password on-premises can immediately log into the cloud.
• PHS can be combined with Seamless SSO so users on domain-joined computers log into the cloud without entering their password again.
• Supports password writeback — a cloud password reset can sync back to AD.

#Pass-through Authentication (PTA)

Pass-through Authentication validates passwords directly in local AD through an authentication agent. The cloud never stores a hash; every time a user logs into a cloud application, the request is forwarded to the agent, which checks the password against on-premises AD, then returns the result.

Because validation still happens in AD, policies like password age, disabled account status, and lockout apply immediately without needing synchronization. Install at least two agents on different servers for high availability — if one server dies, authentication keeps running.

#Federation with AD FS

Active Directory Federation Services (AD FS) is the most complex model: authentication happens on-premises at AD FS, and the cloud trusts the claims AD FS issues. This enables custom claim rules, on-premises MFA, and integration with applications that don't support modern protocols.

That flexibility comes at a price: AD FS and Web Application Proxy (WAP) must be managed, monitored, and backed up. AD FS becomes a critical component — if it dies, cloud logins die too. Use it only when there's a genuine requirement, such as custom claims rules or regulatory obligations.

#Installing Azure AD Connect

Azure AD Connect is the synchronization bridge between AD and the cloud. Prerequisites: an Entra ID tenant, an accessible on-premises domain, and admin accounts on both sides. After downloading the installer, run:

msiexec /i AzureADConnect.msi /quiet
Import-Module "C:\Program Files\Microsoft Azure AD Sync\Tools\ADSync"
Get-ADSyncConnector | Select-Object Name, Type
Start-ADSyncSyncCycle -PolicyType Delta

Behind the installer there's a sync engine: the component that reads objects from AD via a connector, maps them into the metaverse space, then forwards changes to the cloud. Connector rules determine the transformations — e.g. mapping local sAMAccountName to the cloud userPrincipalName, or excluding certain attributes from sync.

#Password Writeback and Device Writeback

Two features that round out hybrid identity:

• Password writeback — users who forget their password can reset via the cloud (e.g. via self-service password reset), and the new password is written back to local AD. Enable it in Azure AD Connect and make sure your license supports it.
• Device writeback — device objects from Entra ID are written back to AD so hybrid Azure AD join can be applied: devices are recognized by both environments and can be evaluated by Conditional Access.

#Seamless SSO and Azure AD Connect Health

• Seamless SSO — domain-joined computers use Kerberos to silently get a TGT in the cloud; users aren't asked to sign in when opening their first cloud application.
• Azure AD Connect Health — a monitoring agent that reports sync health: failed cycles, erroring objects, and lag between cycles. Install it right after setup so sync issues are detected before they become incidents.

#Conclusion

In this episode you understand the hybrid identity landscape:

• Hybrid identity unifies local and cloud identities under one source of truth.
• Three authentication models: PHS (simple), PTA (on-prem validation), and AD FS (full federation) — choose the simplest that meets your needs.
• The Azure AD Connect sync engine maps local objects to the cloud via connector rules.
• Password writeback and device writeback extend identity management in both directions.
• Azure AD Connect Health keeps synchronization healthy.

With hybrid identity, AD is no longer confined to the server room. In episode 21, we prepare the toolbox for when everything goes wrong: Active Directory troubleshooting tools — dcdiag, repadmin, ntdsutil, dsquery, nltest, netdom, and klist. See you there!