3.1.3. Hybrid Identity
💡 First Principle: Many organizations have years of investment in on-premises Active Directory and can't simply abandon it, so hybrid identity synchronizes those existing on-premises identities into Microsoft Entra ID, letting one set of credentials work both on-premises and in the cloud instead of maintaining two separate, disconnected identity systems.
Two tools can do the synchronization: Microsoft Entra Connect Sync, the long-established sync server installed on premises, and Microsoft Entra Cloud Sync, a lightweight agent whose configuration is managed from the cloud and which Microsoft describes as its strategic direction for hybrid identity. Whichever tool syncs the identities, organizations also choose one of three authentication approaches: password hash sync (a hash of the on-prem password hash is synced to the cloud, so Entra ID can authenticate independently), pass-through authentication (Entra ID forwards the authentication request to validate against on-premises AD directly, so the password never leaves the premises), or federation (an on-premises federation server, like AD FS, handles authentication and Entra ID trusts its assertions — the same federation concept from Phase 2.2.5).
⚠️ Exam Trap: Hybrid identity does not mean Active Directory and Microsoft Entra ID become the same directory — they remain two distinct systems kept in sync, not merged into one.
Reflection Question: An organization wants users to keep their existing on-premises passwords working in the cloud, but does not want the actual password hash ever stored in Microsoft's cloud. Which hybrid authentication method fits, and why?
