2.1.2.2. Design for hybrid identity

💡 First Principle: A unified identity that spans both on-premises and cloud environments is essential for providing a seamless user experience, centralizing identity management, and consistently enforcing security policies across a hybrid enterprise.

Scenario: You are designing an identity solution for a large organization that currently uses an on-premises Active Directory but wants to move most of its applications to Azure. Users need to be able to sign in with their existing corporate credentials to both on-premises and cloud applications without a cumbersome experience.

Hybrid identity is a solution that connects your on-premises Active Directory to Azure AD, creating a single user identity that works across both cloud and on-premises environments.

Azure AD Connect is the cornerstone tool for implementing hybrid identity. It synchronizes user accounts, password hashes, and selected attributes from on-premises AD to Azure AD, ensuring consistency and enabling users to sign in with the same credentials in both worlds.

Authentication methods supported by Azure AD Connect:

• Password Hash Synchronization (PHS): The simplest method. It synchronizes a hash of the user's password hash from AD to Azure AD. Users authenticate directly with Azure AD, and no on-premises connectivity is required at sign-in time.
• Pass-through Authentication (PTA): When users sign in to Azure AD, authentication requests are securely passed to on-premises AD in real time. This allows for on-premises password policies and disables cloud authentication if the local account is disabled.
• Federation (AD FS): Authentication requests are redirected to an on-premises AD FS (Active Directory Federation Services) server, enabling advanced scenarios like smart card or third-party MFA.

⚠️ Common Pitfall: Under-provisioning or not making the on-premises components (Azure AD Connect server, PTA agents, AD FS farm) highly available. A failure of these components can disrupt authentication for all cloud applications.

Key Trade-Offs:

• Resilience vs. Real-time Policy Enforcement: PHS is the most resilient option as it has no real-time dependency on-premises for authentication. PTA and Federation offer real-time policy enforcement (e.g., account disabled on-prem immediately blocks cloud access) but are dependent on on-premises connectivity.

Reflection Question: How does designing for hybrid identity, utilizing Azure AD Connect and selecting an appropriate authentication method (e.g., PHS), fundamentally streamline user experience and centralize identity management, reducing administrative overhead and improving security across both on-premises and cloud environments?