Skip to main content

Hybrid Identity Architecture: Entra Connect Sync & Custom Domain Routing

The "Why" Before the "How": The Identity Bridge​

In an enterprise environment, identity is your new perimeter. When organizations operate isolated Active Directory Domain Services (AD DS) on-premises alongside Microsoft 365 or Azure workloads, users end up juggling separate credentials, administrators manage bifurcated access controls, and security teams lose centralized visibility over authentication telemetry.

Building a Hybrid Identity infrastructure bridges this divide. By deploying Microsoft Entra Connect Sync on an on-premises domain controller or dedicated member server, we establish Active Directory as the authoritative source of truth for user accounts, while synchronizing security principals and password hashes to Microsoft Entra ID.

The result? Users enjoy seamless single-identity access across legacy Kerberos file shares and cloud apps, while security teams enforce centralized Multi-Factor Authentication (MFA) and Conditional Access policies at the cloud gateway.

[Authoritative Scope & Lab Parameters]
  • On-Premises Domain Controller: DC01.corp.contoso.com (10.1.1.10)
  • Authoritative Internal Domain: corp.contoso.com
  • Public Custom Vanity Domain: lab.dariocruz.dev (Managed via Cloudflare DNS)
  • Tenant Scope: Microsoft Entra ID Developer Tenant / M365 E5

1. Architectural Decisions: Authentication Topology​

Before touching the installer, you must make a foundational architectural choice on how authentication will be evaluated. Entra Connect supports three primary topologies:

TopologyMechanics & Traffic FlowFailover BehaviorEnterprise Fit
Password Hash Sync (PHS)The sync engine extracts a one-way mathematical hash of the user's NTLM password hash from AD DS, hashes it 1,000 times with SHA-256, and synchronizes the result to Entra ID. Authentication happens directly in the cloud.100% Cloud Autonomous: If your on-premises ISP or lab switch dies, users can still log into Microsoft 365 and cloud services without interruption.Recommended Standard: Simplest, most resilient, and required for Entra ID Identity Protection leaked credential detection.
Pass-Through Authentication (PTA)Password hashes never leave on-premises. When a user logs into cloud apps, Entra ID forwards the validation request to an on-premises lightweight agent running on your servers, which validates credentials against AD DS in real time via Kerberos.Dependent on On-Premises Uptime: If your lab or on-premises servers go offline, cloud authentication freezes.Regulated environments where policy strictly forbids password hashes from residing in the cloud.
Active Directory Federation Services (AD FS)Claims-based federated trust redirecting authentication to dedicated on-premises AD FS farm.High complexity, requires public reverse proxies, public certificates, and heavy compute overhead.Legacy architectures or specialized smart-card/third-party MFA requirements.

(For our homelab and enterprise engineering baseline, we standardize on Password Hash Sync (PHS) with Seamless Single Sign-On enabled).

2. Resolving the UPN Routing Trap: Adding the Custom Domain​

Out of the box, Active Directory installs with a private internal namespace (e.g., corp.contoso.com or .local). If you synchronize users with an unroutable UPN suffix, Microsoft Entra ID cannot route federated authentication and will forcibly rewrite the user's login name to the default tenant domain:

User UPN in AD DS: dario.cruz@corp.contoso.com ➔ Entra ID UPN: dario.cruz@yourtenant.onmicrosoft.com

To maintain a consistent enterprise user experience, we map our verified public domain (lab.dariocruz.dev) into Active Directory:

Step 1: Add Alternative UPN Suffix in Active Directory Domains and Trusts​

  1. Open Active Directory Domains and Trusts on DC01.
  2. Right-click the root node Active Directory Domains and Trusts and select Properties.
  3. Under Alternative UPN suffixes, enter lab.dariocruz.dev and click Add followed by Apply.

Step 2: Bulk Update Existing Users via PowerShell​

Run this snippet to update the UserPrincipalName of all enterprise users to match the public routable domain:

# Target the enterprise organizational unit
$TargetOU = "OU=Enterprise-Users,OU=Enterprise,DC=corp,DC=contoso,DC=com"
$NewDomain = "lab.dariocruz.dev"

Get-ADUser -Filter * -SearchBase $TargetOU | ForEach-Object {
    $NewUPN = "$($_.SamAccountName)@$NewDomain"
    Set-ADUser -Identity $_.DistinguishedName -UserPrincipalName $NewUPN
    Write-Host "Updated UPN for $($_.SamAccountName) -> $NewUPN" -ForegroundColor Cyan
}

3. Scoping Synchronization: Never Sync the Entire Directory​

One of the most dangerous rookie mistakes in hybrid identity is letting the wizard sync your root directory. Synchronizing default built-in accounts, service accounts, and privileged administrators (krbtgt, Domain Admins, Backup Operators) directly into Entra ID violates the principle of administrative boundary isolation.

The Dedicated Synchronization OU Hierarchy​

We enforce synchronization filtering based on organizational units (OU-based filtering):

DC=corp,DC=contoso,DC=com
├── Builtin (NEVER SYNC)
├── Computers (NEVER SYNC)
├── Domain Controllers (NEVER SYNC)
└── OU=Enterprise
    ├── OU=Admin-Accounts (NEVER SYNC - Managed via cloud-only PIM)
    ├── OU=Service-Accounts (NEVER SYNC - Managed via gMSA)
    └── OU=Sync-Scope (INCLUDED IN ENTRA CONNECT)
        ├── OU=Users
        ├── OU=Groups
        └── OU=Shared-Mailboxes
[The Tier 0 Isolation Rule]

Never synchronize Tier 0 on-premises privileged accounts (Domain Admins, Enterprise Admins) into Microsoft Entra ID. Cloud administrators should always be Cloud-Only accounts protected by FIDO2 keys and Privileged Identity Management (PIM). Bridging on-premises domain admin credentials to the cloud creates a bidirectional path for total domain compromise.

4. Verification: Trust, but Verify​

Once synchronization is configured, verify that the sync cycle is healthy and inspect attribute flow:

1. Check Active Directory Sync Scheduler via PowerShell​

Get-ADSyncScheduler

Expected Healthy Output:

AllowedSyncCycleInterval            : 00:30:00
CurrentlyEffectiveSyncCycleInterval : 00:30:00
CustomizedSyncCycleInterval         : 
PeriodicSyncCycleEnabled            : True
PurgeRunHistoryInterval             : 7.00:00:00
SyncCycleInProgress                 : False
MaintenanceEnabled                  : True

2. Trigger an Immediate Delta Synchronization Cycle​

Start-ADSyncSyncCycle -PolicyType Delta

3. Validate Identity in Microsoft Entra Admin Center​

  1. Navigate to Identity > Users > All Users.
  2. Filter by On-premises sync enabled = Yes.
  3. Confirm that users reflect the verified UPN suffix (@lab.dariocruz.dev) and that Directory Synchronization status reports healthy without attribute conflicts.