🎯 Entra ID Course · Final Module 8 of 8
Entra Connect, Monitoring & Identity Governance
SC-300 Exam Alignment — Final Module
SC-300
Implement hybrid identity, monitor identity, and plan identity governance: Microsoft Entra Connect vs Cloud Sync, hybrid authentication methods (PHS/PTA/Federation), sign-in and audit logs, Identity Secure Score, Access Reviews, PIM, and Identity Protection.
- Know Connect vs Cloud Sync: Connect is full-featured (installed on-prem server); Cloud Sync is lightweight (agent-based, simpler). Cloud Sync does NOT support device sync or Exchange hybrid attributes
- Know the three hybrid authentication methods: PHS (hash of hash synced to cloud — most resilient), PTA (auth forwarded to on-prem DCs — password stays on-prem), Federation (AD FS — most complex)
- Know sign-in log types: interactive, non-interactive, service principal, managed identity
- Know PIM: eligible vs active assignments, JIT activation, requires Entra ID P2
- Know Access Reviews purpose: periodic review of who has access, with auto-removal of unconfirmed access
Exam Tip: PHS (Password Hash Sync) is Microsoft's recommended hybrid authentication method — it is the most resilient (no on-prem dependency for cloud auth), enables Identity Protection risk signals (cloud-side password validation enables leaked credential detection), and supports Seamless SSO. If the question asks what to do when on-premises systems are down and users need M365 access, the answer is PHS — PTA and Federation fail when on-prem auth servers are unavailable.
The final module covers the operational and governance layer of Entra ID — connecting cloud identity to on-premises Active Directory, monitoring what's happening in your identity environment, and governing who has what access over time. These capabilities span the full identity lifecycle from provisioning to de-provisioning.
🔗 Hybrid Identity — Entra Connect vs Cloud Sync
For organisations with on-premises Active Directory, Microsoft provides two sync engines to bridge on-prem and cloud identity.
| Microsoft Entra Connect | Microsoft Entra Cloud Sync | |
|---|---|---|
| Architecture | Full sync engine installed on a Windows Server on-premises. Uses Microsoft Identity Integration Server (MIIS) engine | Lightweight provisioning agent installed on-prem. Sync logic runs in the cloud |
| Installation | Requires a dedicated Windows Server with SQL (Express or full) | Small agent installed on any domain-joined server. No SQL required |
| Multi-forest support | Full support for complex multi-forest, multi-domain topologies | Supports multiple disconnected forests but with limitations — no support for intra-org trust sync |
| Device sync | ✅ Supported — hybrid Entra join requires Connect | ❌ Not supported |
| Exchange hybrid attributes | ✅ Supported (msExchMailboxGuid, etc.) | ❌ Not supported — cannot be used in Exchange hybrid deployments |
| Password Hash Sync | ✅ Supported | ✅ Supported |
| Pass-through Authentication | ✅ Supported | ❌ Not supported |
| Group writeback | ✅ Supported | ✅ Supported (v2 groups) |
| Sync interval | Delta sync every 30 minutes; Full sync on demand | Every 2 minutes (near-real-time) |
| Best for | Complex environments, Exchange hybrid, device sync, large organisations | Simple deployments, multiple disconnected forests, organisations wanting minimal on-prem footprint |
🔐 Hybrid Authentication Methods
| Method | How It Works | Password Location | On-prem dependency? | Recommended? |
|---|---|---|---|---|
| Password Hash Sync (PHS) | A hash of the password hash (not the actual password) is synced to Entra ID. Authentication happens entirely in the cloud | Cloud (as hash) | ❌ No — cloud auth works even if on-prem is down | ✅ Yes — Microsoft recommended |
| Pass-through Authentication (PTA) | User signs in via cloud; authentication request is forwarded to on-prem AD domain controllers via an on-prem PTA agent | On-premises only — password never leaves AD | ✅ Yes — on-prem DCs must be reachable | For organisations that cannot store any password in cloud |
| Federation (AD FS) | Authentication handled entirely by on-prem AD FS. Entra ID trusts AD FS tokens. Most complex to maintain | On-premises only | ✅ Yes — AD FS servers must be available for all logins | Only when required for specific legacy SSO scenarios |
💡 Seamless Single Sign-On (Seamless SSO)
Seamless SSO works alongside PHS and PTA (not Federation) to silently authenticate domain-joined Windows devices to cloud apps without any password prompt. When a user opens a browser on a domain-joined machine connected to the corporate network, they are automatically signed into Microsoft 365 via a Kerberos ticket exchange — no username or password required. Configured via Microsoft Entra Connect settings and requires a computer account (AZUREADSSOACC) to be created in on-prem AD.
📊 Sign-in Logs & Audit Logs
Found under Monitoring & health, these are the primary diagnostic tools for identity issues.
| Log Type | What It Shows | Retention |
|---|---|---|
| Interactive user sign-ins | Sign-ins where the user provided credentials (username/password, MFA). Includes CA policy results, risk level, device info, location, and failure reason | 30 days (P1/P2), 7 days (Free) |
| Non-interactive sign-ins | Automatic token refresh and service-to-service auth where no user interaction occurred. High volume but important for diagnosing silent failures | 30 days (P1/P2) |
| Service principal sign-ins | App-to-app authentication using service principal credentials (client secrets, certificates) | 30 days (P1/P2) |
| Managed identity sign-ins | Azure resources (VMs, App Services) authenticating via managed identity — no credential management required | 30 days (P1/P2) |
| Audit logs | Directory changes — user created, group modified, role assigned, policy changed, app registered. Who did what, when | 30 days (P1/P2), 7 days (Free) |
| Provisioning logs | Automated provisioning events — user created in SaaS app via SCIM, HR-driven provisioning | 30 days |
⚠️ Log Retention Beyond 30 Days
To retain logs beyond 30 days (required for many compliance frameworks), configure Diagnostic Settings (Monitoring & health → Diagnostic settings) to export logs to: an Azure Log Analytics workspace (for querying with KQL), an Azure Storage Account (for long-term archival), or an Azure Event Hub (for streaming to SIEM tools like Microsoft Sentinel). Diagnostic settings can forward all four log types simultaneously.
🏛️ Identity Governance Overview
Privileged Identity Management (PIM) — Requires P2
PIM provides just-in-time (JIT) privileged access — instead of holding an admin role permanently, a user has an eligible assignment and activates the role only when needed.
| Assignment Type | What It Means |
|---|---|
| Active (permanent) | User always has the role — available without activation. Not recommended for high-privilege roles |
| Eligible | User can activate the role when needed. Activation requires: MFA, justification text, optional approval, max activation duration (default 8 hours). Role expires after the duration unless re-activated |
✅ PIM Benefits
- Reduces the attack surface — admin roles are only active when needed, not 24/7
- Creates an audit trail — every activation is logged with justification and time
- Supports approval workflows — high-privilege activations can require a second admin to approve
- Sends alerts — notifications when a role is activated or when eligible users are at risk
- Integrates with Access Reviews — regularly review who has eligible or active role assignments
Access Reviews — Requires P2
Access Reviews provide a systematic, recurring mechanism to verify that the right people have the right access. Reviewers (managers, resource owners, or the users themselves) confirm or deny access, and results can be auto-applied to remove unconfirmed access.
| What Can Be Reviewed | Common Use Cases |
|---|---|
| Group membership (Security groups, M365 Groups) | Quarterly review of all members of the "Admin-Tools" group |
| Application access (enterprise app assignments) | Annual review of all users with access to an HR SaaS app |
| Entra ID role assignments | Quarterly review of all active and eligible Global Administrator assignments |
| Guest user access | Semi-annual review of all guest accounts — confirm or remove stale guests |
Entra ID Protection — Requires P2
Identity Protection uses Microsoft's threat intelligence to detect and respond to identity risks automatically.
| Feature | Description |
|---|---|
| Risk detections | Machine learning signals: atypical travel, anonymous IP, malware-linked IP, leaked credentials, password spray, impossible travel, suspicious browser, unfamiliar sign-in properties |
| Risky users | Aggregated risk score for a user (Low/Medium/High) based on accumulated risk detections. High-risk users should be investigated and remediated |
| Risky sign-ins | Per-sign-in risk score — each authentication attempt is evaluated in real-time. High-risk sign-ins can trigger CA policy enforcement |
| Risk-based CA policies | Conditional Access conditions: Sign-in risk = High → require MFA or block. User risk = High → require password change |
| Remediation | Dismiss risk (false positive), require user to reset password (self-remediation), or confirm compromised |
PowerShell — Monitoring & Governance
Connect-MgGraph -Scopes 'AuditLog.Read.All','Directory.Read.All','IdentityRiskyUser.Read.All' # Get recent interactive sign-in logs Get-MgAuditLogSignIn -Filter "createdDateTime ge 2024-01-01" -Top 50 | Select-Object UserPrincipalName,AppDisplayName,Status,CreatedDateTime # Get failed sign-ins only (errorCode ne 0 = failure) Get-MgAuditLogSignIn -Filter "status/errorCode ne 0" -Top 100 | Select-Object UserPrincipalName,Status,CreatedDateTime # Get audit log (directory changes) Get-MgAuditLogDirectoryAudit -Top 50 | Select-Object ActivityDisplayName,TargetResources,InitiatedBy,ActivityDateTime # Get users flagged as risky by Identity Protection Get-MgRiskyUser | Where-Object RiskLevel -ne 'none' | Select-Object UserPrincipalName,RiskLevel,RiskState
💡 Best Practices
- Deploy Password Hash Sync even if you primarily use PTA or Federation — PHS as a fallback ensures users can still authenticate to Microsoft 365 if on-premises infrastructure fails
- Export sign-in and audit logs to a Log Analytics workspace — the 30-day portal retention is insufficient for most compliance requirements; Log Analytics provides 90 days by default and up to 2 years with custom retention settings
- Convert all permanent Global Administrator assignments to PIM eligible assignments — no one should hold Global Admin 24/7. Activate it only for the duration of the specific admin task
- Create quarterly Access Reviews for all privileged role assignments (Global Admin, User Admin, Security Admin) — role creep accumulates when people change jobs but keep old role assignments
- Enable Identity Protection risk-based CA policies for users at High risk — automatically require password change when a high-risk signal is detected rather than relying on manual investigation of every alert
🎓 Interview Q&A
Q: An organisation's on-premises data centre suffers an extended outage. Users with Pass-through Authentication (PTA) cannot sign into Microsoft 365. What could have prevented this?
Enabling Password Hash Sync (PHS) alongside PTA as a backup authentication method. Microsoft supports configuring PHS + PTA simultaneously — PTA is the primary method, but if PTA agents cannot reach on-premises domain controllers (due to a DC outage or network failure), PHS can be used as a fallback so users can still authenticate against the cloud-synced hash. This is why Microsoft recommends PHS even for organisations that primarily use PTA or Federation — it provides resilience against on-premises dependency failures. The fallback can be configured in the Entra Connect setup.
Q: What is the difference between an eligible and an active PIM role assignment, and why does the distinction matter?
An active assignment means the user permanently holds the role and can use it at any time without any additional steps — this is how traditional role assignments work. An eligible assignment means the user has been approved to activate the role when needed, but it is not active by default. To use the role, the user must activate it through PIM, which typically requires completing MFA, providing a business justification, and optionally getting approval from another admin. The role remains active for a limited time (e.g., 8 hours) and then expires. The distinction matters for security: eligible assignments dramatically reduce the attack surface because the privileged role is only active during the brief window when it's actually needed. A compromised account with an eligible assignment does not immediately give an attacker Global Admin access — they would still need to pass MFA and the activation challenge.
🎯 SC-300 Mock Test
Module 8 — Entra Connect, Monitoring & Governance
5 questions · Scenario-based · Pass mark: 70%
Q1 of 5
An organisation needs to sync users from three separate, disconnected Active Directory forests to a single Entra ID tenant. They also need to sync hybrid Entra joined devices. Which sync tool should they use?
AMicrosoft Entra Cloud Sync — it supports multiple forests and is simpler to deploy
BMicrosoft Entra Connect — required for device sync (hybrid Entra join) and supports multiple forest topologies
CEither tool works — both support device sync and disconnected forests identically
DNeither — multiple disconnected forests require separate Entra tenants
Q2 of 5
Microsoft's recommended hybrid authentication method is Password Hash Sync (PHS). A security officer objects, saying passwords should never leave the on-premises environment. How should you address this concern?
APHS does not sync passwords — it syncs an irreversible hash of a hash (PBKDF2 with SHA-256 of the NT hash, salted and iterated). The actual password or even the original NT hash cannot be derived from what is stored in the cloud
BThe security officer is correct — PHS should be avoided and PTA used instead for all hybrid deployments
CPHS can be configured in a compliance mode that encrypts passwords before sending them to Azure
DUse Federation instead — it is more secure than PHS for all environments
Q3 of 5
An IT auditor requests sign-in logs going back 90 days. The Entra admin center only shows 30 days. What should the administrator do?
AContact Microsoft Support — they retain all sign-in logs indefinitely and can export them
BUpgrade to Entra ID P2 — P2 retains logs for 90 days in the portal
CConfigure Diagnostic Settings to export logs to an Azure Log Analytics workspace (future logs) — for past logs beyond 30 days, these are no longer available if not previously exported
DDownload the logs as CSV and request a 90-day extension from Microsoft
Q4 of 5
An organisation wants to ensure that the Global Administrator role is only active for specific users when needed, with mandatory justification and a maximum of 4-hour activation. Which feature implements this?
AConditional Access — create a policy that limits how long admin sessions last
BAdministrative Units — create an AU that restricts Global Admin usage time
CAccess Reviews — schedule hourly reviews of the Global Administrator role
DPrivileged Identity Management (PIM) — configure eligible assignments with a 4-hour max activation duration and mandatory justification
Q5 of 5
Identity Protection detects that a user's credentials appear in a third-party data breach (leaked credentials detection). The user's risk level is set to High. What is the recommended automated response using Conditional Access?
ABlock all sign-ins for the user — leaked credentials are a confirmed compromise
BCA policy with condition User risk = High → Grant: Allow access but require password change (and MFA). The user self-remediates by changing their password
CSend the user an email warning them their credentials were leaked
DManually reset the user's password and inform them
🔒
Locked — Complete Module 7 first.