Azure AD Connect: Hybrid Identity Configuration

Introduction

Azure AD Connect (now Microsoft Entra Connect) synchronizes your on-premises Active Directory with Azure Active Directory (Entra ID), enabling hybrid identity — users sign in to cloud services (Microsoft 365, Azure) using their on-premises AD credentials. This guide covers deploying, configuring, and troubleshooting Azure AD Connect in enterprise environments.

Architecture Options

Password Hash Synchronization (PHS) — Recommended for most:

TEXT

On-premises AD → Azure AD Connect → Azure AD (Entra ID)
- Syncs password hashes (not plaintext passwords)
- Users authenticate directly to Azure AD
- Works even if on-premises is down

Pass-Through Authentication (PTA):

TEXT

On-premises AD → Azure AD Connect → Azure AD
- Authentication agent passes credentials to on-premises AD
- Real-time on-premises policy enforcement
- Requires on-premises to be available

Federation with AD FS:

TEXT

On-premises AD → AD FS → Azure AD
- Complex but maximum control
- SSO using Kerberos on domain-joined machines
- Requires AD FS infrastructure

Installing Azure AD Connect

TEXT

Prerequisites:
- Windows Server 2019 (dedicated server recommended)
- .NET Framework 4.7.2+
- Domain Admin credentials for on-premises AD
- Global Admin credentials for Azure AD/Microsoft 365
- Port 443 outbound to *.microsoftonline.com

POWERSHELL

# Check prerequisites before installing
# Verify .NET version
[System.Runtime.InteropServices.RuntimeEnvironment]::GetRuntimeDirectory()

# Check TLS 1.2 is enabled
[Net.ServicePointManager]::SecurityProtocol

# Download and run Microsoft Entra Connect installer
# installer.microsoft.com/download/details/miid=47594
# Follow wizard: Use Express settings for simple deployments

Express settings configuration:

TEXT

1. Connect to Azure AD: Global Admin credentials
2. Connect to AD DS: Domain Admin for COMPANYAdministrator
3. Azure AD sign-in configuration:
   - Verify your domain is verified in Azure AD
   - Select UPN suffix: user@company.com (not user@company.local)
4. Ready to configure: Enable synchronization

Configuring Synchronization Rules

POWERSHELL

# After installation: view sync rules
Get-ADSyncRule | Select-Object Name, Direction, Priority | Sort-Object Priority

# Custom sync rule: sync additional attributes
# Open Synchronization Rules Editor (GUI)
# Or use PowerShell:
$rule = New-ADSyncRule `
  -Name "In from AD - User Department Sync" `
  -Direction Inbound `
  -ConnectorName "COMPANY.LOCAL" `
  -LinkType Join

# Add transformation
$transformation = New-ADSyncTransformation `
  -TransformationType Direct `
  -SourceAttribute "department" `
  -DestinationAttribute "department" `
  -FlowType Import

Add-ADSyncRuleTransformation -Rule $rule -Transformation $transformation
Add-ADSyncRule $rule

OU Filtering (Sync Only Specific OUs)

POWERSHELL

# Configure which OUs to sync
# Exclude service accounts, disabled users, etc.
Set-ADSyncDomainJoiningFilter -ConnectorName "COMPANY.LOCAL" `
  -ADObjectTypeFilters @{
    User      = @("OU=Employees,DC=company,DC=local", "OU=Contractors,DC=company,DC=local")
    Group     = @("OU=Security Groups,DC=company,DC=local")
    Computer  = @()  # Don't sync computers
  }

# Trigger sync after configuration change
Start-ADSyncSyncCycle -PolicyType Delta   # Delta = only changes
Start-ADSyncSyncCycle -PolicyType Initial  # Full sync

Monitoring Sync Status

POWERSHELL

# Check last sync result
Get-ADSyncScheduler
# Returns:
# SyncCycleEnabled     : True
# NextSyncCyclePolicyType : Delta
# NextSyncCycleStartTimeInUTC : 6/1/2024 2:30:00 PM

# Check for sync errors
Get-ADSyncCSObject -ConnectorName "COMPANY.LOCAL" -Filter { ErrorCode -ne 0 } |
  Select-Object DN, ErrorCode, ErrorMessage | Format-List

# View Azure AD sync errors (PowerShell)
Connect-MsolService
Get-MsolDirSyncProvisioningError -ErrorCategory PropertyConflict |
  Select-Object UserPrincipalName, ObjectId, PropertyName, PropertyValue

# Health monitoring: install and check
Import-Module ADSyncDiagnostics
Invoke-ADSyncDiagnostics

Common Issues and Fixes

POWERSHELL

# Issue: UPN suffix mismatch (user@company.local vs user@company.com)
# Fix: Set alternate login ID
Set-ADSyncAuthenticationPolicy -AlternateIdAttribute mail

# Issue: Duplicate attributes (samaccountname conflicts)
# Find and fix in Azure AD portal under Sync → Errors

# Issue: Object not syncing (stuck in staging)
# Force re-sync specific object
Invoke-ADSyncCSObjectPasswordHashSync -DistinguishedName "CN=John Smith,OU=Employees,DC=company,DC=local"

# Issue: Password writeback not working
# Enable password writeback feature
$connector = Get-ADSyncConnector -Name "COMPANY.LOCAL"
$connector.Attributes["PasswordManagementEnabled"] = "true"

# Issue: Sync stopped
# Restart the service
Restart-Service ADSync

# Check ADConnect server event log
Get-EventLog -LogName Application -Source "Directory Synchronization" -Newest 20

Hybrid Azure AD Join

POWERSHELL

# Enable computer sync (allow Windows 10/11 to register in Azure AD)
# In Azure AD Connect: Configure → Configure device options
# Enable: Hybrid Azure AD join

# Verify joined devices
dsregcmd /status
# Look for:
# AzureAdJoined: YES
# DomainJoined: YES

# Check device registration on Azure AD portal
Get-MsolDevice -All | Where-Object {$_.DeviceTrustType -eq "ServerAd"}

Azure AD Connect is the foundation of hybrid identity. Keep it healthy: monitor sync errors daily, keep it updated (new versions fix security issues), and test password writeback before enabling self-service password reset for users.