Hybrid Identity with Microsoft Entra Connect

Hybrid identity describes an architecture where an organization keeps its on-premises Active Directory as the authoritative source of user accounts while also enabling those same identities to sign into Microsoft 365, Entra ID-integrated SaaS apps, and Azure resources in the cloud. Microsoft Entra Connect (the successor to Azure AD Connect) is the synchronization engine that runs on a Windows Server, reading user, group, and contact objects from on-premises AD DS and writing corresponding objects into Microsoft Entra ID on a recurring cycle, by default every 30 minutes.

Entra Connect supports three main authentication methods for hybrid users: Password Hash Synchronization (PHS), which securely syncs a hash of the password hash to Entra ID so the cloud can authenticate independently even if on-premises is down; Pass-Through Authentication (PTA), where Entra ID forwards the actual sign-in validation back to lightweight agents that check the password against on-premises AD in real time; and federation, where an external IdP like AD FS issues the token instead of Entra ID doing the password check at all. PHS is Microsoft's recommended default for most organizations because it's the simplest to operate and still allows leaked-credential detection to work against on-premises passwords.

Under the hood, Entra Connect uses a metaverse — a central staging database that reconciles data pulled in through separate connector spaces, one per connected directory (on-premises AD, Entra ID, and optionally other sources) — applying inbound and outbound synchronization rules that decide which attributes flow where and how conflicts are resolved. Administrators scope exactly which OUs and objects participate in sync using organizational unit filtering in the Entra Connect wizard, which is important for excluding service accounts, disabled test users, or an entire OU of contractor accounts that should never appear in the cloud tenant.

Each synchronized object is matched to its cloud counterpart using the immutableID, typically derived from the on-premises objectGUID, and Entra Connect performs 'hard match' when a value already correlates two accounts, or 'soft match' based on matching UPN or proxy addresses when a cloud object was created independently (for example, through a trial Microsoft 365 signup) before hybrid sync was configured — a mismatch here is one of the most common causes of duplicate or orphaned cloud accounts. Because a single Entra Connect server is, by default, a single point of failure for the sync pipeline, Microsoft recommends deploying a staging-mode secondary server that can be promoted to active if the primary fails, and administrators should never run password writeback or device writeback from more than one active server simultaneously.