AZ-800 Administering Windows Server Hybrid Core Infrastructure Exam

Eager to master hybrid server management? Discover how to administer Windows Server Hybrid Core Infrastructure on Azure, setting your path towards the Microsoft Certified: Azure Hybrid Infrastructure Administrator Associate certification!

Intermediate

Gauge your current knowledge

Track Readiness

Set Exam Goal

Intermediate

Gauge your current knowledge

Track Readiness

Set Exam Goal

Enable staged rollout features

Implement and manage hybrid identities

Enable and Manage Staged Rollout in Azure AD Connect

The Transition Flow

The staged rollout feature in Azure AD Connect allows an organization to transition from their existing federated identity provider to managed authentication in Microsoft Entra ID. By using this feature, administrators can selectively pilot cloud authentication with a small group of users before fully switching the entire domain. This staged approach reduces deployment risks because user authentication requests are gradually redirected to the cloud instead of transitioning all users at once.

...

A horizontal process flow showing the staged rollout transition from federated authentication through pilot configuration, monitoring, and final cutover to managed authentication in Microsoft Entra ID.

Configuration Steps

To set up the pilot environment, an administrator performs the following steps in order:

Sign in to the Microsoft Entra admin center with appropriate administrative credentials.
Search for Microsoft Entra Connect and navigate to the staged rollout of cloud authentication section.
Select the option to enable staged rollout for managed user sign-in.
Toggle the preferred feature on, such as certificate-based authentication.
Add specific groups to be part of the cloud authentication pilot, keeping group membership under 200 users to avoid timeout issues.

Monitoring and Telemetry

During the pilot phase, traffic flows from the designated users to the cloud, making continuous monitoring essential. Administrators track system health and user experience using two primary tools: Synchronization Logs and Azure AD Sign-in Reports. The logs provide critical data on active synchronization operations, errors, and warnings, while the sign-in reports offer real-time insights into user activities and failed login attempts. This telemetry allows administrators to adjust configuration parameters, such as timeout settings or group memberships, to resolve issues before expanding the rollout.

Security Boundaries and Pilot Considerations

Selecting the right pilot group is critical for finding potential authentication issues across different departments. Administrators should choose pilot groups that represent different parts of the organization to catch a wide range of errors. It is also important to maintain clear security boundaries by keeping highly privileged accounts as cloud-only accounts. Keeping these accounts separate from the on-premises directory limits security risks if the on-premises environment is compromised.

Finalizing the Transition

Once the pilot phase succeeds and telemetry shows stable performance, the organization can transition to full production. The administrator completes the migration by executing these final steps:

Convert the domain from federated authentication to managed authentication.
Monitor the environment continuously during the entire migration process to catch sudden issues.
Disable the staged rollout feature once the final cutover is complete.

...

Manage authentication in on-premises and hybrid environments Implement Group Policy in AD DS

AZ-800 Administering Windows Server Hybrid Core Infrastructure Exam

Enable staged rollout features

Enable and Manage Staged Rollout in Azure AD Connect

The Transition Flow

Staged Rollout: Federation to Managed Authentication

Configuration Steps

Monitoring and Telemetry

Security Boundaries and Pilot Considerations

Finalizing the Transition

Enable and Manage Staged Rollout in Azure AD Connect

The Transition Flow

Configuration Steps

Monitoring and Telemetry

Security Boundaries and Pilot Considerations

Finalizing the Transition