Azure AD & Identity

Azure AD & Identity Management

Master user identity, synchronization, and access management. Azure Active Directory (Microsoft Entra ID) is the foundation of every modern Microsoft 365 deployment.

Complete Administration Guide ▶ Start Course

What is Azure Active Directory?

Azure AD (now Microsoft Entra ID) is Microsoft’s cloud-based identity and access management service. It synchronizes user identities, enables single sign-on, and protects access to all your applications and resources.

Identity Synchronization

Sync users, groups, and contacts from on-premises Active Directory to Azure AD using Azure AD Connect.

Single Sign-On

Users sign in once and access all cloud and on-premises applications without re-entering credentials.

Conditional Access

Protect access based on user, device, location, and risk signals. Block or require MFA dynamically.

Group Management

Security groups, Microsoft 365 Groups, and dynamic groups for managing access to resources at scale.

Authentication Methods

Password Hash Sync, Pass-Through Auth, and ADFS federation for flexible authentication options.

Identity Protection

Risk-based policies, risky sign-ins, compromised credential detection, and automated remediation.

Password Hash Sync vs Pass-Through Authentication

Password Hash Sync (PHS)

Encrypts on-premises password hashes
Sends hashes securely to Azure AD
User signs in with same password
Works even if on-premises is down
Syncs every 30 minutes
Simple setup, fewer servers needed
⚠️ Cloud password changes do NOT sync back

Pass-Through Auth (PTA)

Password NEVER sent to cloud
Real-time validation against on-prem AD
Most secure option available
Requires on-premises to be available
Needs additional agent servers
More complex infrastructure
✅ On-premises policies always enforced

Azure AD Connect — Hard Match vs Soft Match

Hard Match

Uses immutable sourceAnchor identifier
Set automatically on first sync
Cannot change without breaking sync
Most reliable matching method
Used for all standard sync scenarios

Soft Match

Uses email address or UPN to match
Recovery method when hard match fails
Used for orphaned or new users
Less reliable than hard match
Manual intervention sometimes needed

⚡ Common Troubleshooting Scenario

Issue: User created in on-premises AD is not appearing in Azure AD after sync.

1️⃣ Verify user’s OU is included in Azure AD Connect sync scope
2️⃣ Check if user account is enabled in on-premises AD
3️⃣ Look for duplicate email addresses across all users
4️⃣ Open Synchronization Service Manager — search metaverse for user
5️⃣ Check Azure AD Portal for sync errors under Azure AD Connect
6️⃣ Run manual delta sync: Start-ADSyncSyncCycle -PolicyType Delta