The ticket
Cloud team created priya@techclick-lab.in with a welcome password. On-prem is still TECHCLICK\priya.hr. pay-api still needs Kerberos to the LAN database. Two directories, two passwords, one angry Friday. Nobody installed Entra Connect.
Hybrid identity syncs the existing AD forest into Entra (Connect or Cloud Sync) so the same user and group SIDs/UPNs work in cloud apps. Workforce on AWS uses IAM Identity Center (optionally sourced from Entra or AD), not long-lived IAM user access keys. Domain-joined rehosts still talk to dc01 over the VPN until you rebuild the app. A new island of passwords is a second IdP you will never decommission.
On-prem DC dc01 10.20.30.10 · FortiGate fgt-hq 203.0.113.10 · same Azure landing as the Azure series and same AWS landing as the AWS series. Wave-1 app pay-api today on VM 10.20.30.40.
Mental model
- dc01
10.20.30.10remains the on-prem source of authority for wave-1. - Entra Connect (full sync server) or Cloud Sync (light agent) → Entra tenant
techclick-lab.in. - IAM Identity Center for AWS console / SSO. Optional AD Connector if EC2 must join the same forest.
- Service account
TECHCLICK\svc-paystays a domain account on a rehost. Managed identity / IAM role is the refactor.
New cloud-only users for the same humans is the island.
Hybrid identity
How to choose
| Tool | Use | Skip when |
|---|---|---|
| Entra Cloud Sync | This lab / simple forest | You need classic Connect-only features |
| Entra Connect | PTA, federation, complex topology | You wanted a second AD in Azure “just in case” |
| IAM Identity Center | Every human on AWS | Never replace it with IAM users + access keys |
| AD Connector / managed AD | EC2 must domain-join the same forest | As a second password database for people |
Runbook
Side A — source
Confirm
dc01healthy: DNS, time,TECHCLICK\svc-payexists. Do not promote a cloud DC as wave-1.Side B — sync + SSO
Install Cloud Sync agent (or Connect). UPN suffix
techclick-lab.in. Entra groups for Azure RBAC. IAM Identity Center permission sets for AWS — source from Entra if both clouds.Side C — prove one login
Priya opens Azure portal and AWS console with the same synced identity.
pay-apistill starts asTECHCLICK\svc-pay. No new local admin “cloudpass123”.
# On dc01 Get-ADUser svc-pay | Select SamAccountName, Enabled # SamAccountName : svc-pay Enabled : True # Entra / Connect Health: last export success # IAM Identity Center: priya.hr → AWSAdministratorAccess on 111122223333 # No akia… access keys on that human
Four failures
1 · Password island
Cloud-only users with welcome emails. You will run two joiner/mover/leaver processes forever.
2 · Sync after the VM
Rehosted pay-api cannot bind to LDAP / Kerberos because the VPN is up but the computer object / SPN story was never planned.
3 · IAM users for humans
Access keys in a ticket. Identity Center exists specifically so you do not do that.
4 · No break-glass
Conditional Access or an IdP outage locks every admin. Two excluded emergency accounts, stored offline.
How to prove it
1) Sync cycle is healthy. 2) One human signs into Azure and AWS without a second password. 3) svc-pay still works on-prem. 4) No standing IAM user keys for people.
Traps
| Looks done | Is not |
|---|---|
| Entra tenant exists | Forest is not synced |
| AD Connector deployed | Humans still have IAM keys |
| Guest accounts for staff | That is the island |
Knowledge check
Judgment items. One best answer. Reasons send you back to the matching section.
On-prem to cloud migration class series: 6 Rs · Landing zone first · Identity first · VPN / ER / DX · Lift vs rebuild · Map controls · Cutover + rollback · Hybrid interview
Sources
- Microsoft Entra Connect — what it is.
- Microsoft Entra Cloud Sync.
- AWS IAM Identity Center.
- Azure CAF landing zone — identity is a platform piece.
Related: Azure landing zone · AWS Org / OU.