3.1.3. Hybrid Identity
💡 First Principle: Many organizations have years of investment in on-premises Active Directory and can't simply abandon it, so hybrid identity synchronizes those existing on-premises identities into Microsoft Entra ID, letting one set of credentials work both on-premises and in the cloud instead of maintaining two separate, disconnected identity systems.
Microsoft Entra Connect is the synchronization engine, and organizations choose one of three authentication approaches for it: password hash sync (a hash of the on-prem password hash is synced to the cloud, so Entra ID can authenticate independently), pass-through authentication (Entra ID forwards the authentication request to validate against on-premises AD directly, so the password never leaves the premises), or federation (an on-premises federation server, like AD FS, handles authentication and Entra ID trusts its assertions — the same federation concept from Phase 2.2.5).
⚠️ Exam Trap: Hybrid identity does not mean Active Directory and Microsoft Entra ID become the same directory — they remain two distinct systems kept in sync, not merged into one.
Reflection Question: An organization wants users to keep their existing on-premises passwords working in the cloud, but does not want the actual password hash ever stored in Microsoft's cloud. Which hybrid authentication method fits, and why?
