# Identity first: do not invent a second password island Source: https://ai.techclick.in/blog_migrate_identity_ad_to_cloud Markdown: https://ai.techclick.in/blog_migrate_identity_ad_to_cloud.md Publisher: Techclick Infosec Pvt Ltd Hybrid identity first: Entra Connect or Cloud Sync, AWS IAM Identity Center. Do not invent a new password island. ## The ticket Cloud team created priya@techclick-lab.in with a welcome password. On-prem is still TECHCLICK\priya.hr . pay-api still needs Kerberos to the LAN database. Two directories, two passwords, one angry Friday. Nobody installed Entra Connect. Quick interview answer Hybrid identity syncs the existing AD forest into Entra (Connect or Cloud Sync) so the same user and group SIDs/UPNs work in cloud apps. Workforce on AWS uses IAM Identity Center (optionally sourced from Entra or AD), not long-lived IAM user access keys. Domain-joined rehosts still talk to dc01 over the VPN until you rebuild the app. A new island of passwords is a second IdP you will never decommission. Hero · one identity The VM can move. The password file should not fork. Lab data · dummy only On-prem DC dc01 10.20.30.10 · FortiGate fgt-hq 203.0.113.10 · same Azure landing as the Azure series and same AWS landing as the AWS series. Wave-1 app pay-api today on VM 10.20.30.40 . ## Mental model - dc01 10.20.30.10 remains the on-prem source of authority for wave-1. - Entra Connect (full sync server) or Cloud Sync (light agent) → Entra tenant techclick-lab.in . - IAM Identity Center for AWS console / SSO. Optional AD Connector if EC2 must join the same forest. - Service account TECHCLICK\svc-pay stays a domain account on a rehost. Managed identity / IAM role is the refactor . Do not fork the directory - dc01 10.20.30.10 Connect / Cloud Sync or AD Connector Entra ID IAM Identity Center pay-api rehost still domain-joined New cloud-only users for the same humans is the island. https://portal.azure.com Training mock · not live Azure portal Home Management groups Virtual networks Azure Migrate Microsoft Entra Microsoft Entra → Hybrid management → Entra Connect ### Hybrid identity Forest TECHCLICK · dc01 10.20.30.10 Method Cloud Sync (or Connect if you need full PTA/federation) Sign-in Password hash sync · PTA only if required Break-glass Two cloud-only emergency accounts, CA excluded AWS IAM Identity Center sourced from Entra — no IAM user keys Cancel Save Entra hybrid identity. Training mock. ## How to choose Tool Use Skip when Entra Cloud Sync This lab / simple forest You need classic Connect-only features Entra Connect PTA, federation, complex topology You wanted a second AD in Azure “just in case” IAM Identity Center Every human on AWS Never replace it with IAM users + access keys AD Connector / managed AD EC2 must domain-join the same forest As a second password database for people ## Runbook #### Side A — source Confirm dc01 healthy: DNS, time, TECHCLICK\svc-pay exists. Do not promote a cloud DC as wave-1. - #### Side B — sync + SSO Install Cloud Sync agent (or Connect). UPN suffix techclick-lab.in . Entra groups for Azure RBAC. IAM Identity Center permission sets for AWS — source from Entra if both clouds. - #### Side C — prove one login Priya opens Azure portal and AWS console with the same synced identity. pay-api still starts as TECHCLICK\svc-pay . No new local admin “cloudpass123”. identity proof · dummy # On dc01 Get-ADUser svc-pay | Select SamAccountName, Enabled # SamAccountName : svc-pay Enabled : True # Entra / Connect Health: last export success # IAM Identity Center: priya.hr → AWSAdministratorAccess on 111122223333 # No akia… access keys on that human ## Four failures ### 1 · Password island Cloud-only users with welcome emails. You will run two joiner/mover/leaver processes forever. ### 2 · Sync after the VM Rehosted pay-api cannot bind to LDAP / Kerberos because the VPN is up but the computer object / SPN story was never planned. ### 3 · IAM users for humans Access keys in a ticket. Identity Center exists specifically so you do not do that. ### 4 · No break-glass Conditional Access or an IdP outage locks every admin. Two excluded emergency accounts, stored offline. ## How to prove it Close only when 1) Sync cycle is healthy. 2) One human signs into Azure and AWS without a second password. 3) svc-pay still works on-prem. 4) No standing IAM user keys for people. ## Traps Looks done Is not Entra tenant exists Forest is not synced AD Connector deployed Humans still have IAM keys Guest accounts for staff That is the island ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 Wave-1 identity source of authority in this lab? A new Entra-only password file dc01 10.20.30.10 via Connect or Cloud Sync IAM users in account 111122223333 Local admin on pay-api Correct: b . Hybrid first. Q2 Creating new Entra passwords for the same humans is… Required by CAF A password island — do not How Cloud Sync works The 6 R “repurchase” Correct: b . Ticket. Q3 AWS workforce sign-in should be… IAM Identity Center (optionally from Entra/AD) Long-lived IAM user access keys Root on every account FortiGate admin accounts Correct: a . Concept. Q4 svc-pay on a rehost stays… A domain account until you refactor An Entra guest An IAM access key in the web.config Deleted at replica start Correct: a . Rehost vs refactor. Q5 Cloud Sync vs Connect — Cloud Sync is… A second Active Directory The lighter hybrid agent for a simple forest AWS-only A replacement for dc01 in wave-1 Correct: b . Choose. Q6 Break-glass accounts are… Optional if you have MFA Two cloud-only emergencies excluded from CA The pay-api service account Stored in the same Conditional Access grant Correct: b . Failure 4. Check answers Reset On-prem to cloud migration class series: 6 Rs · Landing zone first · Identity first · VPN / ER / DX · Lift vs rebuild · Map controls · Cutover + rollback · Hybrid interview ## Sources - Microsoft Entra Connect — what it is . - Microsoft Entra Cloud Sync . - AWS IAM Identity Center . - Azure CAF landing zone — identity is a platform piece . Related: Azure landing zone · AWS Org / OU . --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt