This project bridges the gap between on premises Active Directory and modern cloud based identity management. By synchronising the LAB.local environment with Microsoft Entra ID, I architected a hybrid identity ecosystem that supports seamless authentication and centralised management. This lab demonstrates advanced skills in identity lifecycle management, UPN transformation, hybrid device joining, and cloud native synchronisation troubleshooting.
Note on Domain Configuration: This lab utilises the default FrankMinaITLab.onmicrosoft.com domain for cost efficiency. In a production environment, a verified, custom public domain would be implemented to ensure professional branding and simplified end user authentication.
- Phase 1: Hybrid Readiness — Domain verification, UPN suffix configuration, and preparation of the AD environment for synchronisation.
- Phase 2: Entra Connect Integration — Deployment and configuration of Microsoft Entra Connect to bridge local Active Directory with the M365 tenant.
- Phase 3: Hybrid Identity & SSO Validation — Verify identity provisioning and ensure a seamless authentication experience through Hybrid Microsoft Entra ID Join and Seamless SSO.
- Phase 4: Security & Governance — Implement Zero-Trust principles to secure the hybrid foundation.
- Hybrid Identity Governance: Expertise in AD-to-Entra synchronisation, UPN transformations, and attribute level object management.
- Cloud Infrastructure & Security: Hardening cloud bound traffic via strictly controlled outbound only NAT rules and implementing secure Hybrid Microsoft Entra Join.
- Sync & Identity Lifecycle: Proficiency in Entra Connect configuration, sync cycle monitoring, and diagnosing object attribute conflicts.
- Operational Resilience: Proactive monitoring and disaster recovery methodologies for identity services.
- Virtualisation Platform: Oracle VirtualBox
- On Premise Infrastructure: Windows Server 2022 (DC01), 5 x Windows 11 Pro workstations
- Cloud Infrastructure: Microsoft 365 E3 Trial Tenant (Entra ID)
- Synchronisation Tools: Microsoft Entra Connect
- Administration & Automation: PowerShell, Entra Admin Center, AD Administrative Center
Architectural Overview: The environment utilises an Entra Connect sync agent to bridge the laboratory foundation with an Azure-based identity control plane. This diagram illustrates the flow of identity data from the on-premises Active Directory to Microsoft Entra ID, facilitating Hybrid Join for workstations and unified access to Microsoft 365 resources.
Note on Security: This hybrid configuration requires strictly controlled outbound firewall rules on the gateway to allow sync traffic (HTTPS/Port 443) while preventing unauthorised inbound access to the local DC.
Objective: Prepared the on premises environment for cloud synchronisation by aligning UPN suffixes and performing data hygiene audits.
Before syncing local identities, I verified the domain in the Microsoft Entra admin center to ensure it is ready to accept synchronised accounts.
- Status: Healthy
To ensure a consistent user experience between on premises and the cloud, I added FrankMinaITLab.onmicrosoft.com as an alternative UPN suffix in Active Directory Domains and Trusts.
| Before | After |
|---|---|
 |
 |
I updated the User Principal Name (UPN) for test accounts to match the cloud verified domain. This allows the Entra Connect sync agent to correctly map local identities to the cloud tenant.
| Before | After |
|---|---|
 |
 |
I performed a manual audit of Active Directory attributes to ensure UPN uniqueness and compliance.
Note: The Microsoft IdFix tool, traditionally used for this process, is being retired on June 30, 2026, with no further development or security updates. To ensure long term viability for this lab, I utilized manual PowerShell auditing rather than relying on legacy software.
Command Used:
Get-ADUser -Filter 'UserPrincipalName -notlike "*"'
Result:
The audit identified only three default system accounts (Administrator, Guest, krbtgt) lacking a UPN. These are built in system objects and are excluded from synchronisation by default. All human provisioned accounts were verified to have correctly configured UPNs, ensuring they are ready for cloud synchronisation.
Objective: Established a hybrid identity bridge by deploying Microsoft Entra Connect to synchronise on premises Active Directory objects with the Microsoft Entra cloud tenant.
I chose to deploy the traditional Microsoft Entra Connect Sync (Connect Sync) to establish a secure synchronisation bridge between the on premises environment and the cloud.
Rationale: While Microsoft recommends Cloud Sync for modern, lightweight deployments, I selected the classic Connect Sync for this lab because it remains the industry standard for complex hybrid environments. Mastering this agent provides deeper insight into synchronisation rules, attribute mapping, and the core mechanics of identity propagation.
Architectural Note:
While Microsoft best practices recommend isolating the Entra Connect Sync service on a dedicated domain joined member server to ensure separation of functions and resource security, this lab environment consolidates the sync agent onto DC01 to optimise for resource efficiency. This design choice prioritises minimising the hardware footprint while maintaining full functional parity with an enterprise level hybrid identity deployment.
Configuration Note: > "I chose the 'Customise' installation path instead of Express settings. This was necessary to correctly handle the non routable .local Active Directory forest and ensure that UPN mapping is explicitly configured to align with my routable cloud domain, preventing authentication conflicts."
To ensure all user identities were compliant with the verified routable cloud domain, I performed a bulk UPN suffix update using PowerShell. This ensured that all local identities were mapped correctly for synchronisation, replacing the non routable @LAB.local suffix with the routable @FrankMinaITLab.onmicrosoft.com suffix.
Automation Script:
Get-ADUser -Filter 'UserPrincipalName -like "*@LAB.local"' | ForEach-Object {
I configured the environment to use Password Hash Synchronisation combined with Single Sign-On (SSO).
Rationale: Password Hash Sync is the most robust and widely used authentication method for hybrid environments, offering excellent reliability with minimal infrastructure overhead. Enabling SSO allows for a seamless authentication experience, mimicking a mature enterprise environment where users are automatically signed into cloud services via their corporate credentials.
I authenticated the synchronisation agent against my Microsoft Entra ID tenant using a Global Administrator account. This established the trusted relationship required for the agent to securely propagate identity data from the on premises domain to the cloud.
I connected the Microsoft Entra Connect service to my on premises LAB.local forest. By creating a dedicated synchronisation account with appropriate directory permissions, I established the necessary bridge to allow user and identity attributes to be read from my local Active Directory for subsequent cloud synchronisation.
Configuration Note: I configured the Entra Connect wizard to "Continue without matching all UPN suffixes," intentionally ignoring the non routable
lab.localsuffix. This action allowed the synchronisation service to proceed, leveraging the previously updated routablefrankminaitlab.onmicrosoft.comUPNs for all synchronised identities.
| Step 1 | Step 2 |
|---|---|
 |
 |
| Step 3 | Complete |
|---|---|
 |
 |
I opted to "Sync all domains and OUs" for the initial configuration. This ensures that the entire directory structure is replicated to Microsoft Entra ID, providing a complete view of the lab environment's identity objects in the cloud. This approach maximises visibility while I explore the synchronisation process.
I configured the synchronisation engine to use "Azure managed source anchors" to link my local users to the cloud.
Why this is the standard:
- Permanent Link: It uses a permanent ID tag (
mS-DS-ConsistencyGuid) for each user. This tag never changes, even if I rename a user or move them around. - Prevents Errors: Because the ID tag is permanent, the cloud always knows exactly who the local user is. This prevents identity confusion and sync errors.
- Set-and-Forget: By letting Azure handle this automatically, I ensure a stable, long term connection between my lab and the cloud without needing manual maintenance.
I configured the sync engine to "Synchronise all users and devices." This ensures my entire lab directory is replicated to the cloud, allowing for a comprehensive and low maintenance test environment.
I maintained the default selection of "Password hash synchronisation." This is a fundamental component of the hybrid identity model, ensuring that user credentials can be validated in Microsoft Entra ID without requiring additional infrastructure such as a full Exchange hybrid deployment.
I provided domain administrator credentials to configure the on premises forest for seamless single sign-on. This step automates the necessary Kerberos computer account configuration, enabling users to authenticate to cloud services automatically while logged into their domain joined machines, significantly enhancing the user experience.
| Before | After |
|---|---|
 |
 |
I reviewed the final summary to ensure all settings—specifically Single Sign-On and password synchronisation were configured correctly.
I made two key choices to finalise the installation:
- Start syncing immediately: I checked this so the service starts working right away, allowing me to verify that my local users are appearing in the cloud.
- Keep Staging Mode off: I left this unchecked because this is a single server lab. I want the server to actively sync with the cloud, not just sit in "backup" mode.
Everything looked good, so I selected "Install" to complete the setup and have the synchronisation process running.
 |
 |
Following the successful configuration, I performed the following verification and hardening steps:
- Service Validation: Confirmed that the "Microsoft Entra ID Sync" service is active on the local host.
- Cloud Sync Check: Verified in the Microsoft Entra admin center that on premises user objects are successfully synchronising.
- Identity Hardening: Enabled the Active Directory Recycle Bin to protect against accidental object deletion.
- SSO Implementation: Configured Group Policy to assign the SSO endpoint to the Local Intranet zone, ensuring seamless authentication for domain joined clients.
| Service Validation | Cloud Sync Check |
|---|---|
 |
 |
| Identity Hardening | SSO Implementation |
|---|---|
 |
 |
 |
Objective: Verify identity provisioning and ensure a seamless authentication experience through Hybrid Microsoft Entra ID Join and Seamless SSO.
I created a test user account (Sync Test) and initiated a manual delta synchronisation.
- Command:
Start-ADSyncSyncCycle -PolicyType Delta
To verify the successful implementation of Hybrid Microsoft Entra ID Join and Seamless Single Sign-On (SSO), the following validation steps were performed:
- Device Identity: Validated device trust via dsregcmd /status (Confirmed AzureAdJoined: YES).
- User SSO Session: Validated user SSO session via dsregcmd /status (Confirmed AzureAdPrt: YES).
- Service Access: Validated service access by navigating to m365.com and confirming automatic sign in without manual credential entry.
- Result: The system authenticated automatically using domain credentials without requiring manual password entry.
Objective: Harden the hybrid identity environment using Zero-Trust principles, focusing on context aware access control and automated endpoint security.
- Conditional Access (CA): Strategy to enforce Multi-Factor Authentication (MFA) for administrative and high risk sign-ins based on location and device health signals.
- Endpoint Management: Planned enrollment of Windows 11 clients into Microsoft Intune for automated configuration profiles, compliance policy enforcement, and remote wipe capabilities.
- Security Baseline: Implementation of Microsoft recommended security baselines to harden the cloud identity surface.
To secure the identity bridge, I implemented a layered Conditional Access strategy.
- Legacy Auth Mitigation: Enabled 'Block legacy authentication' to prevent insecure, older protocols from bypassing MFA.
- Administrative Hardening: Applied 'Multifactor authentication for admins' and 'Azure Management' policies to ensure high-privilege access is always protected by MFA.
- Baseline Enforcement: Deployed 'Require MFA for all users' (User-created policy) to establish a tenant wide security baseline, ensuring that every identity regardless of role is protected.
- Monitoring & Validation: Validated active protection across the tenant, with 5 policies currently enabled to protect users and applications.
| Policy Overview | Configuration Detail |
|---|---|
 |
 |
Dashboard Validation: The Conditional Access overview confirms that the policies are actively protecting the tenant, ensuring continuous monitoring of identity-based risks.
To extend security from identity to the endpoint, I designed an Intune management strategy to enforce device health before allowing access to corporate data.
- Automated Enrollment: Planned GPO-based auto-enrollment to seamlessly bridge on-premises domain-joined devices into cloud management, ensuring no manual intervention is required.
- Compliance Policies: Design specifications to mandate:
- BitLocker Encryption: Ensuring local data remains protected at rest.
- OS Requirements: Minimum Windows 11 versioning to ensure security patches are active.
- Threat Protection: Integration with Microsoft Defender for Endpoint; policies are configured to report device health and automatically flag non-compliant devices if the service is disabled or threats are detected.
- Remote Lifecycle Management: Strategy for implementing 'Remote Wipe' and 'Retire' actions to secure data on lost or stolen assets.
Design Note: Intune acts as the "Compliance Gatekeeper." By integrating with Entra ID, Intune feeds device health data into Conditional Access policies. This ensures that even if a user has the correct credentials, they are denied access if their device is missing encryption or security patches.
- Microsoft Security Baselines: Integration of Intune-managed security baselines to apply industry-standard hardening to Windows 11 settings, reducing the attack surface.
- Audit Logging & Alerting: Implementation of log forwarding to Microsoft Sentinel (SIEM) to provide real-time visibility into identity-based security events and automated incident response.
- Least Privilege: Audit of existing roles to transition from 'Global Admin' usage to 'Role-Based Access Control' (RBAC) using 'Privileged Identity Management' (PIM) concepts.
- SMTP Hard Matching Strategy: To maintain a "Single Source of Truth," I have established a methodology to transition cloud-native identities into synchronised objects using SMTP Hard Matching. This strategy avoids account deletion, preserves existing cloud resource permissions (OneDrive/SharePoint), and ensures that all identities are governed by on-premises Active Directory policies while benefitting from cloud-based security..
- Risk Reduction: Eliminated credential-based attack vectors by enforcing MFA and blocking legacy authentication protocols.
- Visibility: Established audit trails for privileged identity access, ensuring compliance and rapid incident response capabilities.
- Operational Efficiency: Automated device compliance and identity lifecycle management, reducing manual overhead for IT administrators.
Design Note: This security roadmap reflects the "Zero-Trust" maturity model. By moving from simple authentication to context-aware access (Location, Device, Risk), the infrastructure shifts from a perimeter-based model to an identity-centric security model.
- Issue: 'Unsupported browser' error during Entra Connect sign in phase.
- Resolution: Configured Microsoft Edge as the default system browser and temporarily adjusted Internet Explorer Enhanced Security Configuration (ESC) to allow the authentication handoff.
- Takeaway: This highlighted the necessity of ensuring compatibility between cloud based authentication flows and hardened Windows Server environments.
- UPN Consistency: This lab reinforced the critical importance of UPN consistency for synchronisation; ensuring the on premises UPN matches the routable cloud domain is a fundamental prerequisite for identity mapping.
- GPO-Based User Experience: I gained practical experience in using Group Policy Objects to enhance the user experience, specifically by automating the configuration of the Local Intranet zone for SSO.
- Data Hygiene: Proactive data hygiene such as auditing UPNs and cleaning up system level objects before running a sync agent is essential to prevent synchronisation conflicts and ensures a cleaner, more manageable cloud directory.
- Environment Hardening: Working with hardened Windows Server environments highlighted the necessity of managing browser engine compatibility (such as disabling ESC or adjusting default browser settings) to ensure cloud integrated authentication installers function correctly.
- Dedicated Sync Server: In a production environment, isolate the Microsoft Entra Connect Sync service on a dedicated, hardened member server rather than the Domain Controller (DC01) to ensure better resource separation and security posture.
- Public Domain Integration: Replace the default
.onmicrosoft.comdomain with a verified, custom public domain to ensure professional branding and simplified end user authentication. - Azure AD Connect Health: Implement Azure AD Connect Health for proactive monitoring of synchronisation performance, connectivity, and potential sync errors, ensuring enterprise grade operational resilience.
- Automated Audit Tools: While manual PowerShell scripts are effective for labs, adopt Microsoft’s supported identity management tools and compliance dashboards in production environments to maintain long term alignment with evolving cloud security best practices.
Successfully architected and deployed a production-ready Hybrid Identity ecosystem, bridging LAB.local with Microsoft Entra ID. This environment now facilitates:
- Identity Continuity: Implemented Seamless SSO and automated synchronisation, enabling a friction-free user experience.
- Security & Governance: Hardened the identity surface through Conditional Access, MFA, and Intune-managed security baselines.
- Operational Maturity: Established a scalable, Zero-Trust framework capable of supporting advanced device lifecycle management and proactive threat detection.
Future phases will focus on advanced automation using Microsoft Graph API, scaling the environment for multi-site directory integration, and deploying Microsoft Sentinel for proactive threat hunting and security orchestration.
This makes it sound like your roadmap is evolving based on the work you’ve already accomplished.