Implementing and Managing Identity and Access in Hybrid Scenarios
Core concepts
Hybrid identity centers on Microsoft Entra ID as the cloud identity provider and Active Directory Domain Services (AD DS) on-premises, joined by Microsoft Entra Connect (or Connect Sync) and Microsoft Entra Cloud Sync. Candidates must know the difference between password hash synchronization (PHS), pass-through authentication (PTA), and federation with AD FS, plus seamless SSO and hybrid Microsoft Entra join for devices.
Authentication strength and access control matter: Conditional Access policies, multifactor authentication, Microsoft Entra Password Protection (including on-premises agents), self-service password reset with writeback, and Privileged Identity Management for just-in-time roles. Understand groups: cloud-only vs. synchronized vs. dynamic, and that writeback scenarios (groups, devices, passwords) require specific configuration.
Traps to watch
- PTA requires an on-premises authentication agent and does not store password hashes in the cloud; PHS synchronizes hashes. A question asking for "no inbound firewall rules and no federation servers" points to PHS or PTA, not AD FS.
- Cloud Sync is lightweight and does not support all writeback scenarios or complex transformations the way Connect Sync does; do not assume feature parity.
- Hybrid Microsoft Entra join requires a device to be domain-joined and registered; it is not the same as Microsoft Entra registered (BYOD) or cloud-only join.
- Conditional Access does not apply to on-premises-only authentication traffic.
Rule of thumb
Pick the sync engine by scale and features: Cloud Sync for simple, multi-forest, lightweight needs; Connect Sync for advanced transformations and writeback. Pick the auth method by constraint: PHS for resilience and simplicity, PTA when hashes cannot leave premises, federation only when a specific protocol or smartcard requirement demands it.
Worked example
A firm forbids storing password hashes in the cloud and will not deploy AD FS. The correct answer is pass-through authentication with seamless SSO, plus at least three PTA agents for redundancy.