How to Extend Your On-Premises Active Directory to Azure: Entra Hybrid Identity Basics

If you’re running on-premises Active Directory and looking at Azure for the first time, “hybrid identity” can sound a lot bigger and scarier than it actually is. This covers what it really means in practice, the moving parts involved, and where it fits alongside the Entra Connect / Cloud Sync content already on this site.

What “hybrid” actually means here

Hybrid identity means your on-premises Active Directory stays the source of truth for user accounts, while those same identities are synchronized into Microsoft Entra ID (the cloud directory) so users can sign into Microsoft 365, Azure resources, and any other Entra-integrated app with the same credentials. Nothing about your on-prem AD is replaced, it’s extended.

The three sync options, and which one you actually want

• Microsoft Entra Connect Sync: the traditional, most flexible option. Installed on a server you manage, supports complex sync rules and multiple on-prem forests. This is the right choice if you have non-trivial sync requirements (attribute filtering, multiple domains, custom rules).
• Microsoft Entra Cloud Sync: the lighter, agent-based option. Easier to set up and manage (no full server install, Microsoft handles more of the sync engine), designed for simpler environments. If you’re starting fresh with a single, straightforward AD forest, this is generally the recommended starting point today.
• Microsoft Entra Connect (legacy AAD Connect): the older name/version of the first option. If you already have this running, it still works, but new deployments should go with Cloud Sync or the current Connect Sync rather than deploying anything explicitly “legacy.”

(This site already has dedicated walkthroughs for installing and troubleshooting Entra Connect and Cloud Sync specifically, this post is about the bigger-picture decision and architecture, not the click-by-click install.)

What actually gets synchronized

By default: user accounts, group memberships, and a defined set of attributes. Passwords are NOT synchronized in plaintext. Either password hash synchronization (a one-way hash of the hash, not a reversible copy) is used, or authentication is federated back to on-prem (via AD FS) or handled through Pass-through Authentication, where the actual password validation happens against your on-prem domain controller in real time rather than in the cloud at all.

Password Hash Sync vs. Pass-through Authentication vs. Federation

• Password Hash Sync (PHS): simplest to operate, no extra on-prem infrastructure required beyond the sync tool itself, and works even if your on-prem network has an outage (cloud sign-in keeps working). This is Microsoft’s own recommended default for most organizations.
• Pass-through Authentication (PTA): validates the password against on-prem AD at sign-in time via a lightweight agent, so the password itself never leaves your network in any form. Requires that on-prem agent to be reachable, so if your on-prem network is down, cloud sign-in fails too.
• Federation (AD FS): the most complex to operate (a full AD FS farm to build and maintain) and mostly relevant now for specific compliance/certificate-based authentication requirements that PHS/PTA don’t cover. For most new deployments, this is more infrastructure than most organizations need.

A practical first deployment

1. Confirm your on-prem AD is in reasonably good health first (no major replication errors, no orphaned/duplicate UPNs). Sync issues after go-live are very often actually pre-existing AD hygiene issues surfacing for the first time.
2. Verify your UPN suffixes match a domain you’ve verified in Entra ID (or plan to use Entra’s default onmicrosoft.com domain during testing).
3. Choose Password Hash Sync unless you have a specific documented reason not to, since it’s the lowest-maintenance option and Microsoft’s own guidance defaults to it.
4. Run the sync tool’s built-in prerequisite checker before installing anything, since it catches the majority of environment issues (permissions, DNS, connectivity) before they become a mid-installation failure.
5. Sync a small pilot OU first if your directory is large or complex, rather than the entire directory on day one.

Frequently asked questions

Do I need Azure AD Connect if I only use Microsoft 365, not Azure infrastructure?
Yes, Microsoft 365 authentication runs through Entra ID regardless of whether you use any Azure IaaS/PaaS resources at all. “Entra ID” is the identity layer underneath both Microsoft 365 and Azure, not something separate you only need for the latter.

What happens to hybrid sync if my on-premises Active Directory has an outage?
With Password Hash Sync, already-synced users can still sign in to cloud services during an on-prem outage, since the hash comparison happens in the cloud. With Pass-through Authentication or Federation, cloud sign-in depends on reaching your on-prem environment, so an outage there does affect cloud sign-in too, which is worth factoring into which option you choose based on your actual resiliency requirements.