A hands-on hybrid identity and infrastructure lab combining on-premises Windows Server 2022 with Microsoft Azure Entra ID. Built to demonstrate enterprise-grade Active Directory, identity synchronization, networking, storage, virtualization, and cloud integration skills — aligned with AZ-800 and AZ-104 certification objectives.
┌─────────────────────────────────────────────────────┐
│ VMware Workstation (Host) │
│ │
│ ┌─────────────────┐ ┌─────────────────────────┐ │
│ │ DC01 │ │ SERVER02 │ │
│ │ 192.168.10.10 │ │ 192.168.10.20 │ │
│ │ │ │ │ │
│ │ • AD DS │◄──►│ • Domain Member │ │
│ │ • DNS │ │ • DHCP Server │ │
│ │ • Group Policy │ │ • File Services │ │
│ │ • Entra Sync │ │ • DFS Namespace │ │
│ │ • Azure Arc │ │ • Hyper-V Host │ │
│ └────────┬────────┘ └──────────────────────────┘ │
│ │ VMnet10 (192.168.10.0/24) │
└───────────┼─────────────────────────────────────────┘
│ HTTPS
▼
┌─────────────────────────────────────────────────────┐
│ Microsoft Azure │
│ │
│ • Entra ID (kotsvagg83gmail.onmicrosoft.com) │
│ • Entra Cloud Sync │
│ • Azure Arc (DC01 Connected) │
│ • Azure Monitor / Log Analytics │
│ • Microsoft Sentinel │
└─────────────────────────────────────────────────────┘
| Component | Details |
|---|---|
| Hypervisor | VMware Workstation |
| OS | Windows Server 2022 Standard Evaluation |
| Domain | lab.hybrid.local |
| NetBIOS | LAB |
| DC01 IP | 192.168.10.10 |
| SERVER02 IP | 192.168.10.20 |
| Network | VMnet10 — Host-only (192.168.10.0/24) |
| Azure Tenant | kotsvagg83gmail.onmicrosoft.com |
| Azure Region | West Europe |
| # | Module | Status |
|---|---|---|
| 1 | VMware Network & DC01 Setup | ✅ Complete |
| 2 | Active Directory Domain Services | ✅ Complete |
| 3 | SERVER02 Domain Join | ✅ Complete |
| 4 | Group Policy Objects | ✅ Complete |
| 5 | Azure Entra Cloud Sync | ✅ Complete |
| 6 | DHCP Server | ✅ Complete |
| 7 | File Services | ✅ Complete |
| 8 | DFS Namespace | ✅ Complete |
| 9 | Hyper-V | ✅ Complete |
| 10 | Azure Arc | ✅ Complete |
| 11 | Azure Monitor | ✅ Complete |
Configured an isolated Host-only network (VMnet10) in VMware Workstation and deployed the first Windows Server 2022 VM (DC01) with a static IP.
Key configurations:
- VMnet10: 192.168.10.0/24, Host-only, DHCP disabled
- DC01: 4GB RAM, 60GB disk, static IP 192.168.10.10
- Windows Server 2022 Standard Evaluation
Installed the AD DS role on DC01, promoted it to a domain controller, and built the OU structure with test users.
Key configurations:
- Domain:
lab.hybrid.local - OU Structure:
HybridLab > Users / Computers / Groups / ServiceAccounts - Test users: Alice Johnson, Bob Smith, Carol White
- UPN suffix:
kotsvagg83gmail.onmicrosoft.com
Deployed a second Windows Server 2022 VM (SERVER02) and joined it to the lab.hybrid.local domain.
Key configurations:
- SERVER02: Static IP 192.168.10.20
- Successfully joined to
lab.hybrid.local - Verified via
Get-ADComputeron DC01
Created and linked two GPOs using Group Policy Management Console (GPMC) and verified policy application on SERVER02.
GPOs created:
| GPO | Linked To | Settings |
|---|---|---|
| Security-PasswordPolicy | Domain root | Min length 12, complexity, 60-day max age, 5 lockout attempts |
| User-DesktopPolicy | OU=HybridLab | Wallpaper, drive map, restricted Control Panel |
Configured identity synchronization between on-premises Active Directory and Azure Entra ID using Microsoft Entra Cloud Sync (replacing the legacy Connect Sync due to certificate compatibility on free-tier tenants).
Key configurations:
- UPN suffix added:
kotsvagg83gmail.onmicrosoft.com - All user UPNs updated to match Azure tenant
- Sync admin account created:
[email protected] - Entra Cloud Sync agent installed on DC01
- Sync configuration enabled and verified
Note: Microsoft Entra Connect Sync was initially attempted but failed with error AADSTS700027 (expired service principal certificate — known limitation on free-tier tenants). Entra Cloud Sync was used as the modern, lightweight alternative.
Installed the DHCP Server role on SERVER02 and configured a scope to serve IP addresses to lab clients.
Key configurations:
- DHCP role installed on SERVER02
- Scope: 192.168.10.100 – 192.168.10.200
- Subnet mask: 255.255.255.0
- Default gateway: 192.168.10.1
Installed the File Services role on SERVER02 and created a shared folder accessible across the domain.
Key configurations:
- File and Storage Services role installed
- Shared folder:
SharedDocs - Share path:
\\SERVER02\SharedDocs - NTFS and Share permissions configured
Configured a Distributed File System (DFS) Namespace to provide a unified path for shared resources across the domain.
Key configurations:
- DFS Namespace:
\\lab.hybrid.local\HybridLab - Namespace type: Domain-based
- Folder target:
\\SERVER02\SharedDocs→ mapped asSharedDocs
Enabled nested virtualization on SERVER02 within VMware Workstation and installed the Hyper-V role to demonstrate Windows Server virtualization capabilities.
Key configurations:
- VMware VT-x/EPT enabled on SERVER02 VM for nested virtualization
- Hyper-V role installed on SERVER02
- Virtual Switch created:
LabInternalSwitch(Internal network) - Nested VM created:
LabVM01(Generation 1, 512MB RAM)
Onboarded DC01 to Azure Arc, extending Azure management capabilities to the on-premises domain controller.
Key configurations:
- Azure Connected Machine Agent installed on DC01 via PowerShell script
- DC01 registered in Azure Arc as a connected machine
- Resource Group:
sentinel-lab-rg, Region: West Europe - Arc agent status: Connected
- FQDN:
DC01.lab.hybrid.localvisible in Azure portal
Connected DC01 (via Azure Arc) to Azure Monitor and the existing Log Analytics Workspace, enabling hybrid cloud monitoring and telemetry collection from the on-premises domain controller.
Key configurations:
- Azure Monitor Agent configured on DC01 via Arc
- Log Analytics Workspace:
sentinel-lab-workspace - OpenTelemetry metrics enabled (CPU, memory, disk, network)
- Log-based metrics (classic) enabled
- Onboarding status: Successful
| Category | Skills |
|---|---|
| Active Directory | AD DS installation, domain promotion, OU design, user management |
| Group Policy | GPO creation, linking, filtering, verification with gpresult |
| Hybrid Identity | UPN suffix configuration, Entra Cloud Sync, identity synchronization |
| Networking | Static IP configuration, DHCP scope management, DNS |
| File Services | SMB shares, NTFS permissions, DFS Namespace |
| Virtualization | VMware Workstation, Hyper-V nested virtualization, virtual switching |
| Azure Arc | On-premises server onboarding, connected machine agent |
| Azure Monitor | Log Analytics integration, metrics collection, hybrid monitoring |
| Security | Password policies, account lockout, GPO-based hardening |
Hybrid-Identity-Lab/
├── README.md
├── docs/
│ └── screenshots/ # 60 sequential lab screenshots
└── scripts/ # PowerShell scripts used in lab
Evangelos Kotsis System Administrator | Cloud Security Enthusiast
