This repository documents the implementation of a Hybrid Identity environment by integrating an on-premises Active Directory Domain Services (AD DS) environment with Microsoft Entra ID and Microsoft 365.
The project simulates the deployment and administration of a real-world hybrid identity infrastructure commonly found in enterprise environments. It demonstrates how identities created and managed on-premises can be synchronized to the cloud using Microsoft Entra Connect Sync, enabling users to authenticate with Microsoft 365 services using synchronized credentials.
Each ticket represents a realistic administrative task performed by System Administrators, Microsoft 365 Administrators, Identity Administrators, and IT Support Professionals.
- Deploy a hybrid identity environment
- Integrate Active Directory with Microsoft Entra ID
- Configure Microsoft Entra Connect Sync
- Synchronize users and groups to Microsoft 365
- Configure Password Hash Synchronization (PHS)
- Validate hybrid authentication
- Troubleshoot synchronization issues
- Document enterprise administration procedures
- Develop practical Microsoft identity management skills
| Component | Configuration |
|---|---|
| Hypervisor | VMware Workstation Pro |
| Domain Controller | DC01 — Windows Server 2022 |
| Sync Server | SYNC01 — Windows Server 2022 |
| Active Directory | AD DS |
| DNS | Active Directory Integrated |
| Domain | adlab.local |
| DC01 Address | 192.168.66.10 |
| SYNC01 Address | 192.168.66.30 |
| Management | Active Directory Users and Computers |
| Administration | PowerShell |
| Component | Configuration |
|---|---|
| Tenant | Microsoft 365 Business Premium |
| Identity Provider | Microsoft Entra ID |
| Synchronization | Microsoft Entra Connect Sync |
| Authentication | Password Hash Synchronization |
| Administration | Microsoft 365 Admin Center |
| Identity Management | Microsoft Entra Admin Center |
Microsoft 365
▲
│
Microsoft Entra ID
Maggs777.onmicrosoft.com
▲
│
Microsoft Entra Connect Sync
Password Hash Synchronization
OU-based filtering
▲
│
SYNC01
Windows Server 2022
Domain: adlab.local
IP: 192.168.66.30
▲
│
DC01
AD DS + DNS / Windows Server 2022
IP: 192.168.66.10
▲
│
Domain Users & Groups
Microsoft Entra Connect Sync is now operational on SYNC01. Selected on-premises identities are synchronized from Active Directory to Microsoft Entra ID using Password Hash Synchronization and a controlled OU synchronization scope.
- Active Directory Domain Services (AD DS)
- Microsoft Entra ID
- Microsoft Entra Connect Sync
- Password Hash Synchronization (PHS)
- Microsoft 365 Business Premium
- Microsoft 365 Admin Center
- Microsoft Entra Admin Center
- Windows Server 2022
- Windows 11
- PowerShell
- DNS
- Organizational Units (OUs)
- Security Groups
- User Management
- Git
- GitHub
- Hybrid Identity Administration
- Active Directory Administration
- Microsoft Entra ID Administration
- Microsoft 365 Administration
- Identity Synchronization
- Password Hash Synchronization
- User Lifecycle Management
- Organizational Unit Design
- Security Group Administration
- Identity Troubleshooting
- PowerShell Administration
- Enterprise Documentation
- Technical Documentation
- IT Support Best Practices
| Ticket | Status | Description |
|---|---|---|
| HYB-001 | ✅ | Assess Active Directory Environment |
| HYB-002 | ✅ | Configure Active Directory UPN Suffix |
| HYB-003 | ✅ | Update User UPNs |
| HYB-004 | ✅ | Install Microsoft Entra Connect Sync |
| HYB-005 | ✅ | Configure OU Filtering |
| HYB-006 | ✅ | Perform Initial Directory Synchronization |
| HYB-007 | ✅ | Verify Synchronized Users |
| HYB-008 | ⏳ | Configure Password Hash Synchronization |
| HYB-009 | ⏳ | Synchronize Active Directory Groups |
| HYB-010 | ⏳ | Troubleshoot Hybrid Identity Synchronization |
Hybrid-Identity-Entra-ID-Lab
│
├── README.md
├── Ticket-Tracker.md
├── Commands-Used.md
├── LICENSE
│
├── Documentation
│ ├── HYB-001-AD-Environment-Assessment.md
│ ├── HYB-002-UPN-Suffix-Configuration.md
│ ├── HYB-003-User-UPN-Updates.md
│ ├── HYB-004-Entra-Connect-Installation.md
│ ├── HYB-005-OU-Filtering.md
│ ├── HYB-006-Initial-Directory-Synchronization.md
│ ├── HYB-007-Synchronized-User-Verification.md
│ ├── HYB-008-Password-Hash-Synchronization.md
│ ├── HYB-009-Group-Synchronization.md
│ └── HYB-010-Sync-Troubleshooting.md
│
├── Screenshots
│ ├── HYB-001-Assess-Active-Directory-Environment
│ ├── HYB-002-Configure-Active-Directory-UPN-Suffix
│ ├── HYB-003-Update-User-UPNs-for-Hybrid-Identity
│ ├── HYB-004-Install-Microsoft-Entra-Connect-Sync
│ ├── HYB-005-Configure-OU-Filtering
│ ├── HYB-006-Initial-Directory-Synchronization
│ ├── HYB-007-Verify-Synchronized-Entra-ID-Users
│ ├── HYB-008-Password-Hash-Synchronization
│ ├── HYB-009-Synchronize-AD-Security-Groups
│ └── HYB-010-Troubleshoot-Hybrid-Identity-Synchronization
│
└── Diagrams
└── Hybrid-Identity-Architecture.png
By completing this lab, I will gain hands-on experience with:
- Preparing Active Directory for hybrid identity
- Configuring Microsoft Entra Connect Sync
- Managing synchronized identities
- Troubleshooting synchronization issues
- Administering Microsoft Entra ID
- Integrating on-premises infrastructure with Microsoft 365
- Understanding enterprise identity management workflows
The on-premises Active Directory environment has been fully prepared for hybrid identity. A cloud-compatible UPN suffix (Maggs777.onmicrosoft.com) has been configured, and all enabled lab users have been updated to use the new User Principal Name format prior to synchronization.
A dedicated Windows Server 2022 synchronization server (SYNC01) has been deployed with separate internal and NAT network interfaces. The server is domain joined, configured to use DC01 for Active Directory-integrated DNS resolution, and validated for secure-channel communication with the adlab.local domain.
Microsoft Entra Connect Sync is fully operational using Password Hash Synchronization (PHS) as the authentication method. Automatic synchronization is enabled with a 30-minute synchronization interval, Delta synchronization policy, and Staging Mode disabled.
HYB-005 validated selective Organizational Unit (OU) filtering by including the Company\Users, Company\Groups, Company\Computers, and Company\Servers OUs while excluding the Company\Disabled Users OU. User lifecycle behavior was confirmed by moving Emily Carter in and out of the synchronization scope, verifying automatic cloud soft deletion and restoration through Microsoft Entra Connect.
HYB-006 validated the operational synchronization process. The Microsoft Entra Connect scheduler was verified using PowerShell, a manual Delta synchronization was successfully initiated, and the synchronization cycle completed successfully. Synchronized Active Directory users were then verified within Microsoft Entra ID using the On-premises sync attribute, confirming that Active Directory remains the source of authority for synchronized identities.
The hybrid identity environment is now operating as expected with successful synchronization between the on-premises Active Directory environment and Microsoft Entra ID.
The project is now 7 / 10 tickets complete.
HYB-007 validated synchronized identities across the hybrid environment by comparing on-premises Active Directory user objects with their corresponding Microsoft Entra ID and Microsoft 365 identities. User Principal Names (UPNs), synchronization metadata, account status, and identity consistency were successfully verified. The previously disabled Emily Carter account correctly synchronized its disabled state from Active Directory to Microsoft Entra ID and Microsoft 365, demonstrating that account lifecycle changes propagate as expected through Microsoft Entra Connect.
The project is now operating with validated identity synchronization, synchronization metadata, and Microsoft 365 identity integration.
The next implementation phase is HYB-008 — Configure and Validate Password Hash Synchronization, which will focus on validating password changes from Active Directory, synchronizing password hashes to Microsoft Entra ID, and confirming successful Microsoft 365 authentication using synchronized credentials.
Project screenshots are organized by ticket within the Screenshots directory. The folder names mirror the ticket workflow so the implementation evidence can be followed in the same order as the project roadmap.
- Microsoft 365 Administration Lab
- Active Directory Home Lab
- Windows Server Administration Lab
- CompTIA A+ Study Repository
- Seamless Single Sign-On (Seamless SSO)
- Microsoft Entra Cloud Sync
- Microsoft Entra Connect Health
- Password Writeback
- Group Writeback
- Hybrid Azure AD Join
- Microsoft Intune Device Enrollment
- Conditional Access Policy Validation
- Self-Service Password Reset (SSPR)
- Multi-Factor Authentication (MFA)
- Microsoft Learn
- Microsoft Entra ID Documentation
- Microsoft Entra Connect Documentation
- Windows Server Documentation
- Microsoft 365 Documentation
- PowerShell Documentation
Project Status: 🚧 In Progress
This repository is part of a larger enterprise lab portfolio focused on Windows Server, Active Directory, Microsoft Entra ID, Microsoft 365, identity management, and IT infrastructure administration.