Hybrid identity with Microsoft Entra Connect
Most real AD DS deployments connect to Microsoft Entra ID so users have one identity. The exam tests which tool and which sign-in method fits a requirement. Note that “Azure AD Connect” was renamed Microsoft Entra Connect, and questions may still use the old name.
Two sync tools
| Entra Connect Sync | Entra Cloud Sync | |
|---|---|---|
| Runs | Full server on-premises | Lightweight agent, configured in cloud |
| Multi-forest | Yes, complex | Yes, simple |
| Writeback | Password, device, group | Password writeback; fewer others |
| Device sync, hybrid join | Yes | No |
| Filtering | Domain, OU, attribute | Scoping filters |
Pick Cloud Sync to minimise on-premises components; keep Connect Sync for hybrid join, device writeback, heavy customisation or Exchange hybrid.
Sign-in methods
- Password hash synchronization (PHS): a hash of the password hash is stored in the cloud. Simplest, no extra servers, and sign-in survives an on-premises outage.
- Pass-through authentication (PTA): the password is validated against AD DS by agents. Use it when hashes must not be stored in the cloud.
- Federation (AD FS): the most complex; needed only for special requirements.
Optional features in Connect
- Password writeback: required for self-service password reset to write back to AD DS.
- Device writeback: used with on-premises device-based access and with Windows Hello for Business in hybrid deployments.
- Group writeback: writes cloud groups to AD DS.
- Directory extension attribute sync and app and attribute filtering: control which attributes go to the cloud.
Managing sync
Start-ADSyncSyncCycle -PolicyType Delta
Get-ADSyncSchedulerUse Synchronization Service Manager to review operations and errors, and the Synchronization Rules Editor to change attribute flows. The custom banned password list for hybrid users is set in the Microsoft Entra admin center under Password protection, and enforced on-premises by installing the proxy service and DC agent.
Exam traps
- Delta syncs changes only; Initial is a full sync.
- Cloud Sync does not do hybrid device join.
- The custom banned password list is configured in the cloud, not in Active Directory Users and Computers.
- Pass-through authentication needs on-premises agents; PHS does not.
Practice questions
Choose an answer, then review the explanation to check your understanding.
1. Users in a hybrid environment must be able to reset their password in the cloud and have it written to on-premises AD DS. Which Microsoft Entra Connect option do you enable?
Show answer
Answer: B.Password writeback sends self-service password resets back to AD DS. It also requires a licence that supports it.
2. A company has many disconnected AD DS forests and wants the lightest on-premises footprint for syncing to Microsoft Entra ID. What fits best?
Show answer
Answer: B.Cloud Sync uses a small agent, is configured in the cloud, and supports multi-forest setups with fewer components.
3. Which tool do you use to see sync errors and run a manual delta sync on the Entra Connect Sync server?
Show answer
Answer: A.Synchronization Service Manager shows run history. Run Start-ADSyncSyncCycle -PolicyType Delta to sync now.
4. On-premises users must sign in to Microsoft 365 with the password hash stored in the cloud, with no extra servers. Which sign-in method?
Show answer
Answer: C.Password hash synchronization needs no additional infrastructure and works even if on-premises AD DS is down.