Lab 13: Hybrid Identity Readiness

Overview

In this lab, I prepared the Active Directory side of the hybrid identity build before introducing Microsoft Entra Connect or Cloud Sync. The earlier Microsoft 365 and Entra labs established the cloud tenant, user administration model, SSPR pilot and sign-in troubleshooting workflow. This lab created a clean on-premises pilot boundary that can be used safely in the next stage of the hybrid identity rollout.

The work focused on readiness rather than synchronization. I created a dedicated Hybrid Pilot OU structure, confirmed that nietz.co.uk is available as an alternate UPN suffix, checked a pilot user's sign-in name, and created security groups to identify approved user, device and support/admin validation candidates. The Nietz Ltd > Hybrid Pilot OU was documented as the planned technical synchronization boundary for the next lab.

Objective

The objective was to prepare a controlled Active Directory scope for future Microsoft Entra synchronization without changing the whole domain. The pilot groups identify approved users, devices and support/admin validation users for the rollout, while the Nietz Ltd > Hybrid Pilot OU provides the planned technical boundary for scoped Entra Connect synchronization.

Environment

Configuration and Evidence

1. Hybrid Pilot OU Structure Created

I created a dedicated Hybrid Pilot OU under the Nietz Ltd AD structure with separate child OUs for users, groups and devices.

Context: A dedicated pilot OU provides a clear future synchronization boundary without immediately placing the wider Active Directory estate in scope.

2. Public UPN Suffix Confirmed

I confirmed that nietz.co.uk is configured as an alternative UPN suffix in Active Directory Domains and Trusts.

Context: Aligning on-premises UPNs with the Microsoft 365 domain helps users sign in with the same identity format across on-premises AD and Microsoft Entra ID.

3. Pilot User UPN Aligned

I checked Kate Jones' AD account properties and confirmed her user logon name uses the @nietz.co.uk UPN suffix.

Context: Confirming UPN alignment before synchronization avoids confusing sign-in differences between AD usernames and cloud usernames.

4. Hybrid Pilot Security Groups Created

I created three Global Security groups inside the Nietz Ltd\Hybrid Pilot\Groups OU to represent approved user, device and support/admin validation candidates for later targeting and validation.

Context: Security groups make the pilot candidates easier to understand, audit and reuse for future access control, Conditional Access, Intune targeting or deployment targeting. The technical synchronization boundary for the next lab is the Hybrid Pilot OU.

5. Pilot User Group Membership Validated

I added Chloe Bennett and Kate Jones to GRP_HYB_Pilot_Users and confirmed the membership from the group properties. This recorded them as approved users for the hybrid identity pilot.

Context: At the readiness stage, the pilot group records which users are approved for the hybrid identity pilot. In the next lab, selected pilot objects are placed inside the Hybrid Pilot OU because OU filtering is used as the Entra Connect synchronization boundary.

6. Pilot Support/Admin Group Membership Validated

I added Chloe Bennett to GRP_HYB_Pilot_Admins as the pilot Service Desk support/admin validation user and confirmed the membership from the group properties.

Context: Keeping the support/admin validation group separate from the user pilot group supports clearer delegation and validation in later hybrid identity labs without implying broad infrastructure or tenant-wide administrator access.

Validation

The lab was validated when the Hybrid Pilot OU structure existed with dedicated Groups, Users and Devices child OUs, and the nietz.co.uk UPN suffix was confirmed in Active Directory Domains and Trusts.

Readiness was further validated by confirming Kate Jones' UPN alignment, creating the three Global Security pilot groups, and confirming membership for the user and support/admin validation pilot groups. The groups identify approved pilot candidates, while the planned technical sync scope for the next lab is OU=Hybrid Pilot,OU=Nietz Ltd,DC=corp,DC=nietz,DC=co,DC=uk.

Key Technical Outcomes

This lab demonstrated Active Directory preparation for a controlled hybrid identity rollout, including OU design, UPN suffix validation, user sign-in alignment and pilot governance group creation.

It also separated readiness work from synchronization work. The pilot groups document approved users, devices and support/admin validation users, while the next lab can introduce Entra Connect against the known Hybrid Pilot OU boundary.