T Techclick ← All lessons
Cloud · On-prem → Azure / AWS · Lesson 3 of 8

Identity first: do not invent a second password island

pay-api runs as TECHCLICK\svc-pay against dc01 10.20.30.10. If you stand up a fresh Entra tenant of new passwords, Priya has two identities and the service account has none. Hybrid identity first — Entra Connect or Cloud Sync to Entra, IAM Identity Center plus optional AD Connector on AWS. Then the VM can move.

Updated 2026-08-18·18 min read·L2 primary·Quiz at end

After this page you can

The ticket

Cloud team created priya@techclick-lab.in with a welcome password. On-prem is still TECHCLICK\priya.hr. pay-api still needs Kerberos to the LAN database. Two directories, two passwords, one angry Friday. Nobody installed Entra Connect.

Quick interview answer

Hybrid identity syncs the existing AD forest into Entra (Connect or Cloud Sync) so the same user and group SIDs/UPNs work in cloud apps. Workforce on AWS uses IAM Identity Center (optionally sourced from Entra or AD), not long-lived IAM user access keys. Domain-joined rehosts still talk to dc01 over the VPN until you rebuild the app. A new island of passwords is a second IdP you will never decommission.

Hero · one identity
dc01 syncing to Entra and IAM Identity Center
The VM can move. The password file should not fork.
Lab data · dummy only

On-prem DC dc01 10.20.30.10 · FortiGate fgt-hq 203.0.113.10 · same Azure landing as the Azure series and same AWS landing as the AWS series. Wave-1 app pay-api today on VM 10.20.30.40.

Mental model

Do not fork the directory
dc0110.20.30.10 Connect / Cloud Syncor AD Connector Entra ID IAM Identity Center pay-api rehoststill domain-joined

New cloud-only users for the same humans is the island.

https://portal.azure.com
Training mock · not live
HomeManagement groupsVirtual networksAzure MigrateMicrosoft Entra
Microsoft Entra → Hybrid management → Entra Connect

Hybrid identity

TECHCLICK · dc01 10.20.30.10
Cloud Sync (or Connect if you need full PTA/federation)
Password hash sync · PTA only if required
Two cloud-only emergency accounts, CA excluded
IAM Identity Center sourced from Entra — no IAM user keys
Entra hybrid identity. Training mock.

How to choose

ToolUseSkip when
Entra Cloud SyncThis lab / simple forestYou need classic Connect-only features
Entra ConnectPTA, federation, complex topologyYou wanted a second AD in Azure “just in case”
IAM Identity CenterEvery human on AWSNever replace it with IAM users + access keys
AD Connector / managed ADEC2 must domain-join the same forestAs a second password database for people

Runbook

  1. Side A — source

    Confirm dc01 healthy: DNS, time, TECHCLICK\svc-pay exists. Do not promote a cloud DC as wave-1.

  2. Side B — sync + SSO

    Install Cloud Sync agent (or Connect). UPN suffix techclick-lab.in. Entra groups for Azure RBAC. IAM Identity Center permission sets for AWS — source from Entra if both clouds.

  3. Side C — prove one login

    Priya opens Azure portal and AWS console with the same synced identity. pay-api still starts as TECHCLICK\svc-pay. No new local admin “cloudpass123”.

identity proof · dummy
# On dc01
Get-ADUser svc-pay | Select SamAccountName, Enabled
# SamAccountName : svc-pay   Enabled : True

# Entra / Connect Health: last export success
# IAM Identity Center: priya.hr → AWSAdministratorAccess on 111122223333
# No akia… access keys on that human

Four failures

1 · Password island

Cloud-only users with welcome emails. You will run two joiner/mover/leaver processes forever.

2 · Sync after the VM

Rehosted pay-api cannot bind to LDAP / Kerberos because the VPN is up but the computer object / SPN story was never planned.

3 · IAM users for humans

Access keys in a ticket. Identity Center exists specifically so you do not do that.

4 · No break-glass

Conditional Access or an IdP outage locks every admin. Two excluded emergency accounts, stored offline.

How to prove it

Close only when

1) Sync cycle is healthy. 2) One human signs into Azure and AWS without a second password. 3) svc-pay still works on-prem. 4) No standing IAM user keys for people.

Traps

Looks doneIs not
Entra tenant existsForest is not synced
AD Connector deployedHumans still have IAM keys
Guest accounts for staffThat is the island

Knowledge check

Judgment items. One best answer. Reasons send you back to the matching section.

Q1

Wave-1 identity source of authority in this lab?

Correct: b. Hybrid first.
Q2

Creating new Entra passwords for the same humans is…

Correct: b. Ticket.
Q3

AWS workforce sign-in should be…

Correct: a. Concept.
Q4

svc-pay on a rehost stays…

Correct: a. Rehost vs refactor.
Q5

Cloud Sync vs Connect — Cloud Sync is…

Correct: b. Choose.
Q6

Break-glass accounts are…

Correct: b. Failure 4.

On-prem to cloud migration class series: 6 Rs · Landing zone first · Identity first · VPN / ER / DX · Lift vs rebuild · Map controls · Cutover + rollback · Hybrid interview

Sources

Related: Azure landing zone · AWS Org / OU.