Microsoft Entra Connect - Simply Explained

Microsoft Entra Connect is one of those Microsoft technologies almost everyone working with Microsoft 365 has heard about, but its actual job is often misunderstood. Why do organizations need it? What exactly gets synchronized between Active Directory and Microsoft Entra ID? Where are passwords checked? And what happens if synchronization stops working? In this episode of Microsoft Knowledge Nuggets on M365 FM, we break Microsoft Entra Connect down into its essential building blocks: synchronization, authentication, and health monitoring.WHY HYBRID IDENTITY EXISTSFor many years, companies managed employee identities primarily through on-premises Active Directory. Employees signed into Windows, accessed internal file shares, used printers, and reached applications inside the corporate network using an account maintained locally.Then work moved into the cloud. Email moved to Exchange Online, meetings and collaboration moved into Microsoft Teams, personal files moved into OneDrive, and shared content increasingly moved into SharePoint. Microsoft 365 therefore needed its own cloud identity system: Microsoft Entra ID.Organizations that continue using Active Directory while also using Microsoft Entra ID operate a hybrid identity environment. The challenge is making sure those two identity systems represent the same employees instead of becoming two disconnected directories.ACTIVE DIRECTORY AND MICROSOFT ENTRA IDThink of Active Directory as the organization's local records room. It contains employee identities, departments, email addresses, group memberships, and information used to determine access to resources inside the corporate network.Microsoft Entra ID can be viewed as the cloud reception desk. When employees access Teams, Exchange Online, SharePoint, OneDrive, or other cloud services, Entra ID identifies them and participates in determining whether they should receive access.Both systems can therefore contain information about the same person, but they serve different environments. Microsoft Entra Connect provides the controlled bridge between them.ONE EMPLOYEE, TWO IDENTITY SYSTEMSImagine a new employee named Alex joins the company. IT creates Alex's account in Active Directory so Alex can sign into a company Windows device and access local resources.But Alex also needs Teams, Exchange Online, OneDrive, SharePoint, and other Microsoft 365 services. Without synchronization, IT could end up manually creating and maintaining another identity in the cloud.That creates obvious problems. A department might change in one system but not the other. An employee could leave and have the local account disabled while the cloud account remains active. Passwords and other information could gradually become inconsistent.Microsoft Entra Connect links those identity records so they represent the same employee.THE SOURCE OF AUTHORITYFor synchronized users, Active Directory normally remains the source of authority for synchronized identity information.If Alex moves from Sales to Marketing, administrators update the authoritative local record and Microsoft Entra Connect carries the appropriate change into Microsoft Entra ID. This prevents administrators from independently maintaining the same synchronized information in two places and potentially creating conflicting records.Microsoft Entra Connect therefore does not eliminate either directory. It maintains the relationship between them.BUILDING BLOCK ONE: SYNCHRONIZATIONMicrosoft Entra Connect Sync runs on a Windows Server within the organization's environment. That server acts as a controlled bridge between local Active Directory and Microsoft Entra ID.Importantly, organizations do not necessarily synchronize everything stored in Active Directory. Local directories often contain service accounts, test identities, disabled users, training accounts, and other objects that have no reason to exist in Microsoft 365.Administrators determine which users, groups, contacts, and identity information should cross the bridge.USING ORGANIZATIONAL UNITS TO CONTROL SYNCHRONIZATIONOne common method of controlling synchronization is selecting organizational units, usually called OUs.An Active Directory environment might contain separate OUs for Finance, Sales, HR, IT, test accounts, and service accounts. Organizations can synchronize the employee OUs that require Microsoft 365 while excluding local-only identities.This keeps the cloud directory cleaner and reduces the risk of unnecessary accounts appearing in Microsoft Entra ID.HOW SYNCHRONIZATION WORKS DAY TO DAYMicrosoft Entra Connect periodically checks Active Directory for changes and synchronizes the appropriate differences rather than rebuilding the entire cloud directory every time something changes.When Alex joins the company, Entra Connect detects the new identity and synchronizes the appropriate information. If Alex later changes department, joins another group, receives updated email information, or has the local account disabled, those changes can subsequently flow to Microsoft Entra ID.This is the everyday purpose of synchronization: keeping the cloud identity aligned with the authoritative local identity.IDENTITY SYNCHRONIZATION IS NOT LICENSINGA synchronized Microsoft Entra ID account does not automatically mean an employee receives every Microsoft 365 service.Microsoft Entra Connect synchronizes identity information. Microsoft 365 licensing is a separate process. A license determines which services the employee is entitled to use, and services such as Exchange Online then provision their own workloads accordingly.Think of the synchronized account as creating the employee's identity at the cloud reception desk. The licenses determine which rooms and services that employee can actually use.MATCHING EXISTING CLOUD IDENTITIESSynchronization also needs to understand when a local employee already has a corresponding identity in Microsoft Entra ID.This means synchronization is more sophisticated than simply copying names. The system must establish and maintain a relationship between local and cloud objects representing the same person so that subsequent changes update the correct identity rather than producing unnecessary duplicates.BUILDING BLOCK TWO: AUTHENTICATIONSynchronization creates and maintains the identity relationship, but an identity record alone cannot prove that someone signing in is actually the employee they claim to be.That is authentication.Organizations generally want employees to have a consistent work identity rather than remembering separate passwords for Windows and Microsoft 365. Microsoft Entra Connect supports different approaches for connecting the organization's existing identity environment with cloud authentication.PASSWORD HASH SYNCHRONIZATIONPassword Hash Synchronization is a common authentication approach in hybrid Microsoft environments.Despite the name, Microsoft Entra Connect is not simply sending a readable employee password to Microsoft Entra ID. Protected password information goes through additional processing before the resulting information is synchronized to the cloud.Microsoft Entra ID can then validate the Microsoft 365 sign-in without requiring the organization's local Active Directory infrastructure to participate in every cloud authentication request.This provides an important resilience advantage: cloud authentication can continue without every sign-in depending on a live connection back to the local environment.PASS-THROUGH AUTHENTICATIONPass-through Authentication follows a different model.Microsoft Entra ID receives the cloud sign-in request but uses secure agents inside the organization's network to validate the password against local Active Directory.In simple terms, Microsoft Entra ID asks the local environment to confirm whether the password is correct. This can fit organizations that specifically require Active Directory to participate in password validation, but it also creates an availability dependency on the relevant local infrastructure and agents.FEDERATIONFederation introduces another identity system into the authentication process.An organization might already have a federation environment because of specialized authentication requirements, older applications, smart cards, or other company-specific needs. In those scenarios, Microsoft Entra ID can redirect or delegate parts of the authentication process to the organization's federation infrastructure.Federation can solve legitimate enterprise requirements, but it also introduces additional components that must be operated, monitored, secured, and maintained.WHICH AUTHENTICATION METHOD SHOULD YOU USE?The fundamental difference between Password Hash Synchronization, Pass-through Authentication, and federation is where and how the authentication decision is performed.Password Hash Synchronization allows Microsoft Entra ID to perform cloud authentication using synchronized protected password information. Pass-through Authentication keeps local Active Directory involved in password validation. Federation uses another identity infrastructure to handle the authentication process.The correct choice is therefore based on organizational requirements rather than selecting the architecture that sounds the most sophisticated.Become a supporter of this podcast: https://www.spreaker.com/podcast/m365-fm-modern-work-security-and-productivity-with-microsoft-365--6704921/support.