Eager to master hybrid server management? Discover how to administer Windows Server Hybrid Core Infrastructure on Azure, setting your path towards the Microsoft Certified: Azure Hybrid Infrastructure Administrator Associate certification!
Gauge your current knowledge
Gauge your current knowledge
Organizations that keep user accounts in an on-premises Active Directory Domain Services (AD DS) forest use Microsoft Entra Connect to synchronize those identities to the cloud-based Microsoft Entra ID. This tool copies user accounts and group memberships, enabling users to sign into cloud services with the same username and password they use on-premises. The synchronization is one-way by default, flowing from on-premises AD DS to Microsoft Entra ID, which creates a unified identity across both environments.
Microsoft Entra Domain Services provides a managed domain in Azure, meaning Microsoft handles updates, backups, and security patches for you instead of requiring you to run your own domain controllers on virtual machines. This service offers traditional domain capabilities such as domain join for virtual machines, group policy management, and support for LDAP, Kerberos, and NTLM authentication protocols. Legacy applications that need these older authentication methods can run in Azure without a connection back to your on-premises network.
After synchronization and the managed domain are set up, you must validate that the identity system works as a whole. Users should be able to authenticate to resources in both environments using their single set of credentials. Group policies created in the managed domain must apply correctly to Azure virtual machines that are domain-joined to it. This consistency ensures that security policies and user experiences are uniform whether an application is hosted on-premises or in Azure.
The integration supports different migration strategies. A hybrid identity model uses Microsoft Entra Connect to sync on-premises AD DS with the cloud, allowing a phased migration where some applications move to Azure while others remain on-premises, all using the same directory. In a cloud-only scenario, where there is no on-premises AD, user accounts are created directly in Microsoft Entra ID, and Microsoft Entra Domain Services provides the managed domain services for Azure resources without any VPN or replication to an on-premises network.
Choosing Microsoft Entra Domain Services over deploying your own domain controller virtual machines reduces operational complexity because Microsoft handles the underlying infrastructure, including high availability and disaster recovery. The service automatically synchronizes identity information from your Microsoft Entra ID tenant, so there is no separate directory to manage. This managed approach simplifies administration and allows IT teams to focus on applications rather than maintaining core directory infrastructure.
The first major decision when setting up Microsoft Entra Connect Sync is which authentication method works best for the organization. Password hash synchronization takes user passwords from on-premises AD, hashes them, and copies them to Azure AD so users can log in directly to cloud apps. Pass-through authentication keeps passwords on-premises and validates them against AD when users sign in, which some organizations prefer for extra control. Federation sets up a trust relationship between AD and Azure AD so users get single sign-on without passwords being stored in the cloud. Each option has different security and complexity tradeoffs, and the choice affects how users experience the login process.
Not every user and group from on-premises AD needs to appear in Azure AD. OU filtering lets administrators choose which organizational units sync, so only relevant users get accounts in the cloud. Attribute mapping controls which details about each user travel between systems, such as phone numbers or department names. Organizations can also add directory extensions to store custom information that standard Azure AD attributes do not cover. These customization options help keep the synchronized data clean and relevant to what the business needs.
Once synchronization is running, administrators need to check that it works correctly. Azure AD Connect Health provides a dashboard showing sync status, error counts, and performance metrics. PowerShell commands like Get-ADSyncConnector let technicians query the current state of sync connectors and spot issues quickly. Setting up alerts for failures and reviewing logs regularly catches problems before users notice them, ensuring the hybrid identity system stays reliable.
Microsoft Entra Cloud Sync is a lightweight agent-based service used to provision and synchronize hybrid identities from on-premises environments to the cloud. It acts as a modern, cloud-managed alternative to traditional synchronization tools. Configuration policies live in the cloud, which reduces the local footprint and overhead on your on-premises servers.
To establish the connection between environments, you must install the lightweight provisioning agent on a domain-joined server in your local network. The installation process requires you to download the agent from the Azure portal, run the setup wizard, and register the agent with your tenant. Once registered, the agent establishes an outbound connection to Microsoft Entra ID, meaning you do not need to open inbound ports on your local firewall. This outbound-only design creates a secure communication boundary that protects your internal network while allowing continuous data flow.
After the agent is active, you define which objects migrate to the cloud by configuring scoping filters within the portal. You can restrict synchronization by targeting specific Organizational Units (OUs) or by applying custom attribute filtering to select specific users or groups. Choosing the right scope prevents unnecessary objects from cluttering your cloud directory and reduces sync processing times. If an object falls out of the scoped OUs or fails the attribute criteria, the system automatically stops syncing it, ensuring that only authorized identities exist in the cloud.
Cloud Sync runs on a recurring schedule to ensure that local changes, such as password updates or new user creations, quickly reflect in the cloud. Unlike traditional sync tools that run heavy local cycles, Cloud Sync uses a highly frequent, cloud-orchestrated polling mechanism. This architecture offloads the scheduling engine to Azure, which pulls changes from the on-premises directory at regular intervals. Administrators can monitor these cycles to confirm that updates propagate smoothly without causing performance degradation on local domain controllers.
To keep the synchronization pipeline running smoothly, administrators must actively monitor system health. The Microsoft Entra Connect Health portal provides centralized visibility into the operational state of your agents and active sync processes. This portal displays real-time health alerts, performance metrics, and latency reports to help you detect synchronization delays early. By reviewing these metrics, you can identify resource bottlenecks on your host servers before they impact user access.
When synchronization fails, troubleshooting requires a structured check of the communication path and agent logs. If an agent loses its connection, check outbound network access on ports 80 and 443, which are required for the agent to reach Azure endpoints. Next, review the local Windows Event Logs and the provisioning logs in Microsoft Entra ID to pinpoint why specific objects failed to sync. Resolving these identity mismatches or connectivity blocks promptly restores the seamless flow of data and ensures consistent access for hybrid users.
Microsoft Entra Domain Services (Entra DS) provides domain services such as domain join, group policy, LDAP, and Kerberos/NTLM authentication without requiring you to run your own domain controllers. You create a managed domain using the Microsoft Entra admin center. First, choose a DNS name: you can use the built-in domain name or a custom routable name, but avoid non‑routable suffixes like .local. The domain prefix must be 15 characters or fewer and must not conflict with any existing DNS namespace. Next, select an Azure location and assign the managed domain to its own dedicated subnet—it should not share that subnet with other VMs or services. Finally, add administrative users to the AAD DC Administrators group so they can manage the domain. Before the domain can authenticate users, you must enable password hash synchronization, and users need to change their passwords to generate the correct hashes for NTLM and Kerberos authentication.
To keep the managed domain secure, you enforce policies that control how users sign in and how passwords behave. Conditional Access policies require extra security measures such as multi‑factor authentication (MFA) before a user can complete a sign‑in. All user accounts must comply with these policies before they are synchronized into Entra DS. You also define password policies within Entra DS that match your organization’s security rules. Password hashes from on‑premises Active Directory are synchronized to Entra DS so that users have the same credentials in both environments, and the same password policies apply everywhere.
User accounts, groups, and credentials move from your on‑premises Active Directory to Entra DS through Microsoft Entra Connect. You decide whether to synchronize all users and groups or only a selected set based on your needs. Regular synchronization updates keep the managed domain current with changes made in Microsoft Entra ID. You monitor these updates to catch any delays or mismatches in the replication process, ensuring that the user and group objects stay accurate across the hybrid environment.
Applications that need LDAP access can use secure LDAP (LDAPS) instead of plain LDAP. To enable it, you upload a certificate to your managed domain. Then you configure network security groups (NSGs) to allow inbound traffic on TCP port 636, which is the port that secure LDAP uses. Regularly audit the NSG rules and update certificates as needed to maintain security compliance.
Microsoft Entra Connect Health is a monitoring service that provides insight into your on-premises identity infrastructure. It works by installing a lightweight agent on your identity servers, such as those running Active Directory Domain Services (AD DS) or the Azure AD Connect sync service. This setup allows you to watch over the health and performance of the systems that authenticate your users, whether they are signing into cloud or on-premises resources. Maintaining this visibility is crucial for a reliable hybrid identity environment.
Using this tool offers several important advantages. It enhances security by helping you spot potential threats, like failed sign-in attempts or connections from suspicious locations. Its alert system notifies you immediately about critical problems, allowing for quick fixes. Furthermore, it improves the user experience by providing a clear dashboard within the Microsoft Entra admin center, making it simple to monitor performance and resolve issues that could slow down user access.
Getting started with Entra Connect Health is straightforward. You deploy it by installing the health agents on your relevant on-premises servers. These agents are designed for easy setup and are automatically updated, ensuring you always have the latest features. To use the service, your organization needs Microsoft Entra ID P1 licenses, which grant access to the advanced monitoring and reporting capabilities that Entra Connect Health provides.
Once deployed, the service delivers powerful monitoring. It provides usage metrics, showing you details like which applications are used most, where users are connecting from, and how many authentication requests each server handles. It also performs performance monitoring, tracking server health, connectivity, and availability to help maintain high uptime. Critical issues trigger alerts that are sent via email, giving administrators instant updates so they can act quickly.
A core task is using Entra Connect Health to analyze and fix problems. Within the Azure portal, you can examine synchronization errors between your on-premises AD DS and Microsoft Entra ID. Detailed error reports help you identify and resolve these issues to keep directory synchronization running smoothly. You can also track sign-in performance trends. By monitoring how long sign-ins take and where delays occur, you can proactively address performance bottlenecks, ensuring users have fast and reliable access.
Password Hash Synchronization (PHS) synchronizes the on-premises AD password hash to Azure AD. This method supports single sign-on (SSO), enabling users to authenticate using the same passwords they use on-premises. It improves security by leveraging Azure AD Protection features, such as risk detection and remediation. PHS also reduces infrastructure needs because it avoids the necessity for additional on-premises servers for authentication processes. Organizations typically choose PHS when they want simplicity and reduced on-premises dependency.
Pass-through Authentication (PTA) uses a lightweight agent to validate users' passwords against your on-premises AD without storing passwords in the cloud. This method provides seamless sign-on, so users authenticate with the same credentials they would use on-premises. Security benefits include integration with Microsoft Entra Conditional Access policies and smart lockout capabilities that help prevent attacks. PTA is ideal when regulations do not permit storing passwords in the cloud, making it suitable for organizations with strict compliance requirements.
Federation involves creating a trust relationship between Azure AD and on-premises Active Directory Federation Services (AD FS). This approach supports various authentication protocols like Kerberos and NTLM, providing comprehensive flexibility. Users benefit from single sign-on, accessing both on-premises and cloud resources seamlessly. Enhanced security comes from integrating multifactor authentication (MFA) into the federated environment, providing robust protection for sensitive operations. Federation offers the highest level of flexibility but requires a more complex setup than other methods.
Hybrid identity solutions ensure that users have a single identity across both on-premises and cloud environments, which can be managed through Azure AD Connect. This involves configuring synchronization rules to control which attributes are synchronized from on-premises AD to Azure AD. Administrators monitor and troubleshoot these connections using tools like Microsoft Entra Connect Health to ensure reliability and performance. The synchronization rules determine what user information travels between systems and how identities are mapped.
When selecting an authentication method, organizations consider several factors. PHS works best for simplicity and reducing on-premises dependency. PTA fits organizations where storing passwords in the cloud is not permitted due to regulatory compliance. Federation offers the highest level of flexibility but requires more complex infrastructure and management. The choice depends on specific organizational needs regarding security, compliance, and existing infrastructure capabilities.
The staged rollout feature in Azure AD Connect allows an organization to transition from their existing federated identity provider to managed authentication in Microsoft Entra ID. By using this feature, administrators can selectively pilot cloud authentication with a small group of users before fully switching the entire domain. This staged approach reduces deployment risks because user authentication requests are gradually redirected to the cloud instead of transitioning all users at once.
To set up the pilot environment, an administrator performs the following steps in order. First, sign in to the Microsoft Entra admin center with appropriate administrative credentials. Next, search for Microsoft Entra Connect and navigate to the staged rollout of cloud authentication section. Then, select the option to enable staged rollout for managed user sign-in and toggle the preferred feature on, such as certificate-based authentication. Finally, add specific groups to be part of the cloud authentication pilot, keeping group membership under 200 users to avoid timeout issues.
During the pilot phase, traffic flows from the designated users to the cloud, making continuous monitoring essential. Administrators track system health and user experience using two primary tools: Synchronization Logs and Azure AD Sign-in Reports. The logs provide critical data on active synchronization operations, errors, and warnings, while the sign-in reports offer real-time insights into user activities and failed login attempts. This telemetry allows administrators to adjust configuration parameters, such as timeout settings or group memberships, to resolve issues before expanding the rollout.
Selecting the right pilot group is critical for finding potential authentication issues across different departments. Administrators should choose pilot groups that represent different parts of the organization to catch a wide range of errors. It is also important to maintain clear security boundaries by keeping highly privileged accounts as cloud-only accounts. Keeping these accounts separate from the on-premises directory limits security risks if the on-premises environment is compromised.
Once the pilot phase succeeds and telemetry shows stable performance, the organization can transition to full production. The administrator completes the migration by converting the domain from federated authentication to managed authentication, monitoring the environment continuously during the entire migration process to catch sudden issues, and disabling the staged rollout feature once the final cutover is complete.
Microsoft Entra Connect Health is a monitoring service that provides insight into your on-premises identity infrastructure. It works by installing a lightweight agent on your identity servers, s…
Microsoft Entra Connect Health is a monitoring service that provides insight into your on-premises identity infrastructure. It works by installing a lightweight agent on your identity servers, s…
For organizations that keep user accounts in an on-premises Active Directory Domain Services (AD DS) forest, a tool called Microsoft Entra Connect is used to synchronize those identities to th…
For organizations that keep user accounts in an on-premises Active Directory Domain Services (AD DS) forest, a tool called Microsoft Entra Connect is used to synchronize those identities to th…
When setting up Microsoft Entra Connect Sync, the main job is to keep user accounts in sync between on-premises Active Directory Domain Services (AD DS) and Azure Active Directory (Azure AD). This cre…
When setting up Microsoft Entra Connect Sync, the main job is to keep user accounts in sync between on-premises Active Directory Domain Services (AD DS) and Azure Active Directory (Azure AD). This cre…
The staged rollout feature in Azure AD Connect allows an organization to transition from their existing federated identity provider to managed authentication in Microsoft Entra ID. By usin…
The staged rollout feature in Azure AD Connect allows an organization to transition from their existing federated identity provider to managed authentication in Microsoft Entra ID. By usin…
Microsoft Entra Domain Services (Entra DS) provides domain services such as domain join, group policy, LDAP, and Kerberos/NTLM authentication without requiring you to run your own domain controlle…
Microsoft Entra Domain Services (Entra DS) provides domain services such as domain join, group policy, LDAP, and Kerberos/NTLM authentication without requiring you to run your own domain controlle…
Microsoft Entra Cloud Sync is a lightweight agent-based service used to provision and synchronize hybrid identities from on-premises environments to the cloud. It acts as a modern, cloud-managed a…
Microsoft Entra Cloud Sync is a lightweight agent-based service used to provision and synchronize hybrid identities from on-premises environments to the cloud. It acts as a modern, cloud-managed a…
Integrating on-premises Active Directory (AD) with Azure Active Directory (Azure AD) involves managing hybrid identities and ensuring seamless authentication across environments. This process requires…
Integrating on-premises Active Directory (AD) with Azure Active Directory (Azure AD) involves managing hybrid identities and ensuring seamless authentication across environments. This process requires…
StudyCerts
StudyCerts