Staged Rollout for Hybrid Identity Authentication

Enable and Manage Staged Rollout in Azure AD Connect

The Transition Flow

The staged rollout feature in Azure AD Connect allows an organization to transition from their existing federated identity provider to managed authentication in Microsoft Entra ID. By using this feature, administrators can selectively pilot cloud authentication with a small group of users before fully switching the entire domain. This staged approach reduces deployment risks because user authentication requests are gradually redirected to the cloud instead of transitioning all users at once.

Configuration Steps

To set up the pilot environment, an administrator performs the following steps in order:

1. Sign in to the Microsoft Entra admin center with appropriate administrative credentials.
2. Search for Microsoft Entra Connect and navigate to the staged rollout of cloud authentication section.
3. Select the option to enable staged rollout for managed user sign-in.
4. Toggle the preferred feature on, such as certificate-based authentication.
5. Add specific groups to be part of the cloud authentication pilot, keeping group membership under 200 users to avoid timeout issues.

Monitoring and Telemetry

During the pilot phase, traffic flows from the designated users to the cloud, making continuous monitoring essential. Administrators track system health and user experience using two primary tools: Synchronization Logs and Azure AD Sign-in Reports. The logs provide critical data on active synchronization operations, errors, and warnings, while the sign-in reports offer real-time insights into user activities and failed login attempts. This telemetry allows administrators to adjust configuration parameters, such as timeout settings or group memberships, to resolve issues before expanding the rollout.

Security Boundaries and Pilot Considerations

Selecting the right pilot group is critical for finding potential authentication issues across different departments. Administrators should choose pilot groups that represent different parts of the organization to catch a wide range of errors. It is also important to maintain clear security boundaries by keeping highly privileged accounts as cloud-only accounts. Keeping these accounts separate from the on-premises directory limits security risks if the on-premises environment is compromised.

Finalizing the Transition

Once the pilot phase succeeds and telemetry shows stable performance, the organization can transition to full production. The administrator completes the migration by executing these final steps:

1. Convert the domain from federated authentication to managed authentication.
2. Monitor the environment continuously during the entire migration process to catch sudden issues.
3. Disable the staged rollout feature once the final cutover is complete.