Most engineers think…
Most people assume hybrid identity is just 'install a tool and it syncs'. They then hit a late-night cutover that goes wrong when changing federation to cloud auth — because they never understood which knobs actually control sign-in behaviour.
Hybrid identity is a stack of three decisions: which sync engine (Entra Connect Sync or the newer Cloud Sync), which authentication method (Password Hash Sync, Pass-Through Authentication or Federation with ADFS / third-party IdP), and what optional features layer on top (Seamless SSO, writeback, staged rollout). Getting these three decisions right before you deploy — not during — is what separates a clean migration from a 2 a.m. call.
① Sync engines — Entra Connect Sync vs Entra Cloud Sync
Every hybrid identity deployment needs a sync engine to copy user, group and contact objects from on-premises Active Directory into Microsoft Entra ID. Microsoft offers two: Entra Connect Sync (the mature, server-installed engine) and Entra Cloud Sync (the newer, lightweight agent model where the sync logic lives in the cloud portal, not on your server).
Entra Connect Sync is best when you need deep customisation — complex attribute-flow rules, device writeback, Exchange hybrid writeback, or multi-forest topologies with a single sync server holding the full picture. Entra Cloud Sync suits most new deployments, multi-forest AD environments, and orgs that want Microsoft to manage the sync configuration in the cloud without a dedicated sync server.
Key difference to state in an interview
Entra Connect Sync runs the entire engine on-premises; Entra Cloud Sync runs the engine in Microsoft's cloud and uses a lightweight on-premises agent only to read from AD and write back. Microsoft now recommends Cloud Sync for new deployments where its feature set is sufficient.
What is the main architectural difference between Entra Connect Sync and Entra Cloud Sync?
② Authentication methods — PHS, PTA and Federation
Syncing identities is separate from deciding how users authenticate. After sync, you choose one of three methods. Password Hash Sync (PHS) stores a salted hash of the on-premises password hash in Entra ID. Sign-in happens entirely in the Microsoft cloud — no on-premises call at runtime, so it works even if your data centre is down. It also enables leaked-credential detection (Identity Protection correlates the hash against known breach lists).
Pass-Through Authentication (PTA) keeps the password hash on-premises. When a user signs in to the cloud, Entra ID forwards the credential to a lightweight PTA agent on-premises that validates it against AD in real time. No hash leaves the boundary — good for compliance mandates, but sign-in depends on the agent being reachable. Federation delegates the entire authentication to an external IdP such as ADFS or Okta; the cloud trusts whatever token the IdP issues. Federation gives you smart-card, certificate-based and complex conditional logic, but at the cost of ADFS servers, certificates, and a single point of failure if the IdP is down.
The exam line: PHS = simplest, most resilient; PTA = password stays on-prem; Federation = most control, most infrastructure. All three can coexist with Seamless SSO, and you can migrate from Federation to PHS/PTA using staged rollout without a big-bang cutover.
Syncs a salted hash of the on-prem password hash to Entra ID. Authentication is cloud-only at runtime — works even when on-premises AD is down. Enables leaked-credential detection via Identity Protection.
Password hash stays on-premises. A PTA agent validates credentials against AD in real time when users sign in. Meets compliance mandates that forbid cloud-side password storage, but sign-in depends on agent availability.
Authentication is fully delegated to an on-premises or third-party IdP. Supports smart cards, certificates, and complex claim rules. Requires ADFS servers and Web Application Proxy; down if the IdP is unreachable.
Uses a Kerberos ticket for the AZUREADSSOACC computer account. Domain-joined browsers silently exchange the ticket for a cloud token — no extra password prompt needed on Windows 7/8.1/10/11.
Microsoft strongly recommends enabling Password Hash Sync as a backup even if your primary method is PTA or Federation. If the on-prem IdP or PTA agents go down, you can switch Entra ID's sign-in method to PHS in minutes with no user impact — your disaster recovery strategy costs nothing extra.
A financial regulator forbids storing any password hash outside the organisation's data centre. Which auth method must you choose?
③ Seamless SSO — no password prompt on domain-joined devices
Seamless SSO is an optional feature that layers on top of PHS or PTA (not needed with full federation, which handles SSO itself). When enabled, Entra Connect creates a computer account named AZUREADSSOACC in every synced AD domain and sets a Kerberos service key on it. When a domain-joined Windows device authenticates to a Microsoft 365 resource, the browser silently fetches a Kerberos service ticket for AZUREADSSOACC from the on-premises KDC and sends it to Entra ID's token endpoint, which validates it and issues a cloud token — no password prompt required.
Seamless SSO supports Windows 7, 8.1 and 10/11 domain-joined machines. For Windows 10 and later, Microsoft recommends Primary Refresh Token (PRT) via Hybrid Entra Join or Entra Join as the preferred SSO mechanism — but Seamless SSO is still widely used for down-level clients. Note: starting July 2026 Windows Server will default Kerberos encryption to AES-256 (from RC4), so organisations must ensure the AZUREADSSOACC account key is updated to avoid Seamless SSO failures.
Seamless SSO only removes the password prompt on domain-joined Windows devices using PHS or PTA. It cannot issue SAML tokens, handle smart-card auth, or replace ADFS claim rules. If you still need SAML federation for on-prem apps, ADFS (or a third-party IdP) remains required even with Seamless SSO enabled.
▶ Watch a Password Hash Sync sign-in end to end
How Priya's browser authenticates to Microsoft 365 via PHS + Seamless SSO. Press Play for the healthy path, then Break it to see the classic failure.
Which Active Directory computer account does Entra Connect create to enable Seamless SSO?
④ Attribute writeback & staged rollout
Attribute writeback is the reverse direction of sync: data flows from Entra ID back to on-premises AD. The key scenarios are: Group writeback (Microsoft 365 Groups and security groups pushed to AD so on-prem apps can see them), Device writeback (Entra-registered device objects written to AD for ADFS conditional access), and Password writeback (SSPR writes a changed cloud password back to on-premises AD immediately, keeping both directories in sync). Exchange Hybrid writeback copies Exchange Online mailbox attributes to the on-premises AD so the on-prem Exchange sees full mailbox routing data. Writeback requires Entra Connect Sync or the relevant Cloud Sync feature to be licensed and turned on.
Staged rollout — migrate without a cutover
Staged rollout lets you move a pilot security group from federation to PHS or PTA without converting the entire federated domain at once. You add a group to the staged-rollout feature flag in Entra ID; those users authenticate via PHS/PTA + Seamless SSO while the rest of the domain stays federated. You can test, validate MFA, confirm Conditional Access policies, and then convert the domain only when ready. Limitation: password writeback via SSPR is not supported while a group is in staged rollout, and the maximum number of groups per feature is ten.
Priya at a Mumbai financial services firm faces this
After enabling SSPR (self-service password reset) in Entra ID, users reset their cloud password successfully — but their on-premises AD password is unchanged, locking them out of VPN and on-prem systems an hour later.
Password writeback was not enabled in Entra Connect Sync, so reset passwords are only updated in Entra ID, not written back to on-premises AD.
Check Entra admin centre ▸ Password reset ▸ On-premises integration — the 'Write back passwords to your on-premises directory' toggle shows Off.
Entra admin centre ▸ Password reset ▸ On-premises integrationEnable password writeback in Entra Connect Sync wizard (optional features) and turn on the toggle in the portal. Writeback is near-real-time; after the next sync cycle, SSPR resets will propagate to on-prem AD.
Test SSPR for a pilot user — VPN login with the new password succeeds within one sync cycle (default 30 min delta sync, or trigger an immediate sync with Start-ADSyncSyncCycle -PolicyType Delta).
Run Get-ADSyncConnectorRunStatus in the Entra Connect shell or check the Entra admin centre ▸ Entra Connect ▸ Health dashboard. Connector errors after enabling writeback almost always mean insufficient on-prem AD permissions for the MSOL_ sync account on the writeback target OUs.
You want to move 500 pilot users from ADFS federation to Password Hash Sync without converting the whole domain. What is the correct approach?
🤖 Ask the AI Tutor
Tap any question — instant, scoped to this lesson. No login, no waiting.
Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.
📝 Wrap-up assessment — six more
You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.
🧠 In your own words
In one or two sentences: what three decisions define a Microsoft Entra hybrid identity deployment? Then compare with the expert version.
🗣 Teach a friend
Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.
📖 Glossary
- Entra Connect Sync
- The original Azure AD Connect, now renamed. Runs the full synchronisation engine on a Windows Server with deep attribute-flow customisation and advanced writeback support.
- Entra Cloud Sync
- A newer provisioning model where sync configuration lives in the Entra portal and only a lightweight agent runs on-premises. Preferred for new deployments.
- Password Hash Sync (PHS)
- An authentication method that stores a salted hash of the on-premises AD password hash in Entra ID, enabling fully cloud-side validation and leaked-credential detection.
- Pass-Through Authentication (PTA)
- An authentication method where a lightweight on-prem agent validates credentials against AD in real time; no password hash leaves the corporate boundary.
- Federation
- An authentication model where Entra ID delegates sign-in to an external IdP (e.g. ADFS) and trusts the token it issues. Supports smart cards and complex claim rules.
- Seamless SSO
- A feature that uses a Kerberos service ticket for the AZUREADSSOACC computer account to silently authenticate domain-joined devices to Entra ID without a password prompt.
- Password Writeback
- An Entra Connect feature that propagates SSPR password changes from Entra ID back to on-premises Active Directory in near-real time.
- Staged Rollout
- A migration feature that moves specific security groups from federation to cloud authentication (PHS or PTA) without converting the entire federated domain at once.
📚 Sources
- Microsoft Learn — Choose the right authentication method for Microsoft Entra hybrid identity. learn.microsoft.com/en-us/entra/identity/hybrid/connect/choose-ad-authn
- Microsoft Learn — What is password hash synchronization with Microsoft Entra ID?. learn.microsoft.com/en-us/entra/identity/hybrid/connect/whatis-phs
- Microsoft Learn — Microsoft Entra Connect: Seamless Single Sign-On — how it works. learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sso-how-it-works
- Microsoft Learn — Microsoft Entra Connect: Cloud authentication via Staged Rollout. learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-staged-rollout
- Microsoft Learn — Migrate from federation to cloud authentication in Microsoft Entra ID. learn.microsoft.com/en-us/entra/identity/hybrid/connect/migrate-from-federation-to-cloud-authentication
- OneUptime Blog — How to Set Up Azure AD Connect Cloud Sync for Hybrid Identity with Password Hash Synchronization (2026). oneuptime.com/blog
What's next?
Got the hybrid identity plumbing? Next, go deep on Entra ID Conditional Access — how to gate every sign-in on device compliance, location, risk level and session controls.