3.4. Hybrid Identity
💡 First Principle: One identity, two authorities, one source of truth. Hybrid identity keeps on-premises Active Directory authoritative for object lifecycle while projecting those identities into Entra ID — a one-way river with carefully chosen tributaries back (writeback). Every hybrid decision is really "where does authentication happen, and what fails if the link breaks?"
This section is dense with exam-favorite decision points because most enterprises live here: which sync engine, which authentication method, how to leave AD FS behind, and how to watch the plumbing. Anchor on the river model — objects flow AD → Entra; only specific, opt-in writebacks flow upstream — and each choice becomes a trade-off you can reason through rather than memorize.
⚠️ Common Misconception: Pass-through authentication "sends passwords to the cloud." PTA validates passwords on-premises — Entra hands the encrypted attempt to an outbound-connected agent that checks it against your DCs; nothing password-shaped persists in Entra. PHS stores only an irreversibly re-hashed derivative. Compliance stems banning "passwords in the cloud" usually still permit PHS once you read what's actually stored.