Hybrid identity
checked from directory to sign-in.
We review how your on-premises Active Directory and Microsoft Entra ID stay in sync and how users sign in, using reports and screenshots you choose to share, and give you a written report of risks, conflicts and the fixes to do first.
Who it is for
Organisations with Active Directory synchronised to Microsoft 365 or Azure that want to check sync health and sign-in design, or that are choosing between sync tools or sign-in methods, or planning a change such as a domain rename or a move to cloud sync.
What we review
- Sync tool and version. whether Microsoft Entra Connect Sync or Entra Cloud Sync is in use and whether that choice still fits. Microsoft states that Azure AD Connect V1 is retired and no longer supported, and publishes a migration decision guide for Cloud Sync. Check current Microsoft documentation.
- Sync health. last successful sync, export and import errors, and whether Microsoft Entra Connect Health or another monitor is in place.
- Sign-in method. password hash synchronisation, pass-through authentication or federation: which is in use, whether a fallback exists and the failure modes of each.
- Seamless single sign-on. whether it is enabled and which devices rely on it. Microsoft recommends SSO via primary refresh token on Windows 10 and later and says Seamless SSO is not used on Entra joined or hybrid joined devices. The report also checks how often the Kerberos decryption key of the AZUREADSSO computer account is rolled over; Microsoft recommends at least every 30 days.
- UPN suffixes and domains. UPN suffixes that are not verified in the tenant (Microsoft Entra calculates a different UPN for those users), verified domains, and any alternate login ID configuration.
- Writeback. which writeback features are enabled, such as password writeback for self-service password reset, and whether each is still needed.
- Staged rollout. whether staged rollout, which Microsoft describes as a temporary testing mechanism for federated domains, is still in use after a migration, and who owns it.
- Sync scope. the filtering that controls which objects appear in Entra ID (Microsoft notes the default takes most objects in all configured domains and is generally recommended), and whether privileged on-premises accounts are in scope and need to be.
- Sync errors and matching. errors in the sync error reports, including duplicate attribute and hard-match (source anchor) errors, and how they are resolved.
- Sync and agent servers. patching, backup of configuration, availability of authentication agents, and whether the servers are protected as highly sensitive systems.
- Device registration. hybrid join configuration, where in scope.
What you get
A written report, delivered through the channel agreed in the quote. It contains:
- An executive summary in plain language
- A diagram-style summary of the sync and sign-in design as found
- Findings with severity and the evidence behind each one
- A fix-first list with effort for each item
- A 30/60/90-day plan
- A list of what was not checked and why
See the format in the fictional report sample (sample, fictional data).
What we need from you
- A named contact with authority over Entra ID and Active Directory
- Screenshots or exports of the sync tool configuration and health, authentication method settings and sync error reports named in the scope
- The list of verified domains and UPN suffixes in use
How it works
- Send an enquiry. Tell us the question. Keep credentials and customer data out of it.
- Agree the written scope. We propose scope, fee and timing in writing. Nothing starts until both sides accept it.
- We review what you choose to share. We read only the reports and screenshots in the agreed scope. We do not connect to your sync server, directories or tenant.
- You get a written report. It says what was checked, what was not, and suggested next steps.
- Any change is approved separately. A report does not authorize changes; anything that changes needs its own written approval.
See what the report looks like: Read a fictional report sample (sample, fictional data). How we handle your information: Trust and data handling.
What we need from you. A named contact with authority, and a small set of evidence you choose to share through a channel we agree in writing first. Please do not send credentials, access tokens or customer exports through the enquiry form.
What we do not do. We do not connect to your sync server, change sync scope or rules, reset keys, move users or change sign-in methods. We give no availability or security guarantee.
What needs separate approval. Any change to sync scope, sign-in method, writeback or staged rollout, any key rollover, and any cut-over or re-check after changes.
Questions before an enquiry
Entra Connect or cloud sync: which should we use?
It depends on your topology and the features you need. Microsoft publishes a migration decision guide for checking whether Cloud Sync supports your requirements. The review states what applies in your case. Check current Microsoft documentation.
Do you need access to our sync server?
No. You share the configuration and health reports or screenshots named in the scope.
Will you change the sign-in method or sync scope?
No. We recommend. Changes such as moving from federation to cloud authentication, or changing filters, need a plan, a pilot and your approval.
Does this cover Active Directory health?
Only where it affects sync. For replication, DNS, Group Policy and privileged groups, see the Active Directory health and security review.
We only use Microsoft 365. Do we have hybrid identity?
If users are created in on-premises Active Directory and synchronised to Entra ID, yes. If all users are cloud-only, this review does not apply.
Free tools, reading and vendor documentation
- On-premises Active Directory to Entra ID hybrid checklist
- Roll over the Seamless SSO Kerberos decryption key
- Prerequisites for hybrid Entra ID
- Can Entra ID replace Active Directory?
Microsoft documentation (opens in a new tab). Product behaviour and licensing change, so check current Microsoft documentation before acting:
Ready to start?
Tell us what you need. We reply to confirm fit and to propose scope, fee and timing in writing.