What is Azure AD Connect?

Microsoft Entra Connect — The Bridge Between Worlds
MICROSOFT IDENTITY — TECHNICAL OVERVIEW
microsoft-entra-connect.md
Microsoft Entra Series · Part 01

The Bridge Between
Your Office and the Cloud

Microsoft Entra Connect is the infrastructure that silently keeps your on-premises Active Directory and Microsoft’s cloud in perfect harmony — so your users never have to think about identity twice.

Entra Connect Active Directory Hybrid Identity SSO Password Sync
🏢
On-Premises
Active Directory
Local Server / Domain Controller
Entra Connect
Sync · Auth · SSO
☁️
Cloud
Microsoft Entra ID
Azure AD · Microsoft 365
What Is It

The Identity Bridge, Explained

Microsoft Entra Connect — formerly known as Azure AD Connect — is the tool Microsoft built to connect your on-premises Active Directory environment with Microsoft Entra ID in the cloud.

If your organization runs a traditional Windows Server domain on-premises and uses Microsoft 365 or Azure, this tool is what keeps both systems in sync — so users manage one identity, not two.


Section 01 — Origin

Why Does It Exist?

In the early days of cloud adoption, companies faced a “split-brain” identity problem: users had one password for their office PC and a completely different one for their cloud email. This was a nightmare for both security teams and end users.

Entra Connect was created to eliminate that problem entirely. It solves three specific, recurring pain points:

🔑
Single Identity
Users authenticate with the same credentials for both on-premises workstations and cloud applications like Teams, SharePoint, and Outlook 365.
⚙️
Reduced Overhead
Admins manage users in a single place — on-premises AD. Any change automatically flows to the cloud within minutes. No duplication of effort.
🚀
Seamless Access
Enables Single Sign-On (SSO), so domain-joined users on the corporate network often don’t have to type their password at all when accessing cloud apps.

Section 02 — Architecture

The Core Building Blocks

Entra Connect isn’t a single script — it’s a suite of components working in concert. Understanding each piece helps you diagnose issues faster and plan deployments with confidence.

A
Core Engine
Synchronization Service
The engine of the operation. It pulls identity data from your local AD, compares it against what’s in the cloud, and pushes updates in both directions. It relies on a SQL Server database to track every synchronized object and its state — this is why it needs dedicated server resources.
B
Identity Validation
Authentication Components
This determines how a user proves their identity when logging in. You choose one of three paths at deployment time — and each has different security, resilience, and infrastructure implications:
Recommended
Password Hash Sync
A hashed copy of the password is sent to the cloud. Microsoft handles login. Works even if on-prem is offline.
Compliance
Pass-Through Auth
The cloud asks your local server to validate credentials in real-time. The password never leaves on-premises.
Complex
Federation (AD FS)
A full on-premises AD FS server handles the entire login flow. Maximum control — maximum infrastructure overhead.
C
Visibility Layer
Health Monitoring Agent
A lightweight monitoring agent that streams sync status, performance metrics, and error alerts directly into the Azure Portal. If your sync stalls at 2 AM, you get an alert — before users start calling the help desk at 9 AM. Requires Azure AD Premium P1 or higher.

Think of Entra Connect as a silent postal service running 24/7 between your office and Microsoft’s cloud — constantly checking for changes, syncing updates, and keeping every identity perfectly in step across both worlds.

— Concept Overview · Microsoft Entra Connect
Section 03 — Modern vs. Classic

Entra Connect vs. Cloud Sync

Microsoft has been progressively introducing Microsoft Entra Cloud Sync — a lighter, cloud-native alternative. Understanding the distinction is now essential for any hybrid identity architect.

  Entra Connect vs. Cloud Sync — Feature Comparison
Feature Entra Connect (Classic) Cloud Sync (Modern)
Agent Model Heavy server-side installation Lightweight cloud agent
Sync Logic Location Runs on your local server Runs in Microsoft cloud
Custom Sync Rules ✅ Full support ⚠️ Limited
Multi-Forest Support ✅ Complex topologies ✅ Disconnected forests
Writeback Features ✅ Full (PW, Group, Device) ⚠️ Partial
High Availability Staging mode (manual) ✅ Multiple agents, native
Best For Complex configs & large enterprises Simpler setups & cloud-first orgs

For most large enterprises with custom sync rules, writeback requirements, and complex multi-forest topologies — Entra Connect remains the right tool. Cloud Sync excels in simpler, cloud-first environments where infrastructure simplicity is prioritized over configurability.

Microsoft Entra Connect — Technical Overview Series  ·  For IT Professionals  ·  Part 01 of 06

Leave a Reply

Your email address will not be published. Required fields are marked *