Lab 14: Hybrid Identity Sync Pilot

Overview

This lab extended the hybrid identity readiness work from Lab 13 by introducing a dedicated synchronization server, SYNC1, and configuring Microsoft Entra Connect Sync against a controlled Active Directory pilot scope.

The implementation used OU filtering rather than synchronizing the full domain. Only the Hybrid Pilot OU and its Devices, Groups and Users child OUs were selected. Synchronization was then validated in Microsoft Entra ID by confirming that a pilot user and the hybrid pilot security groups appeared with on-premises source data.

Objective

The objective was to perform a controlled Entra Connect pilot without placing the wider Active Directory estate in scope. The lab also needed to demonstrate realistic pilot governance: validation was completed, an identity issue was identified, and a ServiceNow incident was created before any wider rollout.

Environment

Configuration and Evidence

1. Dedicated Sync Server Prepared

I built a dedicated member server named SYNC1 for the Entra Connect pilot rather than installing the sync service on the domain controller.

Context: Using a member server keeps the sync workload separate from the domain controller and better matches a production-style deployment pattern.

2. Internal Static IP and DNS Configured

I configured the internal adapter on SYNC1 with a static address and pointed DNS to the domain controller.

Context: The sync server must reliably resolve AD domain services before Entra Connect can discover and bind to the on-premises forest.

3. Network and Domain Controller Discovery Validated

I validated that SYNC1 could resolve and contact DC1, and that domain controller discovery worked for corp.nietz.co.uk.

Context: This confirmed the server could locate the domain controller before the Entra Connect installation was started.

4. Domain Join Validated

I signed in with a domain account and confirmed that SYNC1 was joined to corp.nietz.co.uk.

Context: Domain membership allowed the server to authenticate to Active Directory and use domain-based administrative credentials during setup.

5. SYNC1 Moved into the Hybrid Pilot Device OU

I moved the SYNC1 computer object into the Nietz Ltd\Hybrid Pilot\Devices OU and added a clear description to document its purpose.

Context: Placing the sync server in the pilot device OU kept the server object aligned with the controlled hybrid identity scope.

6. Pilot Device Group Membership Confirmed

I added SYNC1 to the GRP_HYB_Pilot_Devices security group and confirmed the membership from the group properties.

Context: This keeps the pilot device inventory auditable and separates device scope from the user and support/admin validation pilot groups.

7. Entra Connect Sync Setup Started

I launched the Microsoft Entra Connect Sync setup wizard on SYNC1.

Context: The wizard was run from SYNC1 after confirming the dedicated pilot server design and prerequisite checks.

8. Active Directory Forest Connected

I connected the on-premises Active Directory forest, corp.nietz.co.uk, to the Entra Connect configuration.

Context: The green check confirms that Entra Connect accepted the AD forest connection and could proceed to sign-in and filtering configuration.

9. Entra Sign-In Domain Mapping Reviewed

I reviewed the UPN suffix mapping. The internal AD suffix corp.nietz.co.uk was not added to Entra ID, while the public suffix nietz.co.uk was verified.

Context: The pilot users were prepared with the public @nietz.co.uk UPN suffix, so the internal AD namespace did not need to be added as a public Entra domain.

10. OU Filtering Scoped to the Hybrid Pilot OU

I configured domain and OU filtering so that only the Nietz Ltd\Hybrid Pilot OU and its child OUs were selected for synchronization.

Context: OU filtering was the main pilot control. It prevented the wider domain from synchronizing during the first Entra Connect test.

11. User Identity Matching Settings Reviewed

I kept the default setting that users are represented only once across all directories and allowed Entra Connect to manage the source anchor.

Context: The lab uses a single on-premises AD forest, so the default identity matching model is appropriate for the pilot.

12. User and Device Filtering Reviewed

I left user and device filtering set to synchronize all users and devices because the pilot scope was already controlled by OU filtering.

Context: In this build, OU filtering is the authoritative boundary. Adding group filtering as well would have made the pilot harder to interpret.

13. Optional Features Reviewed

I enabled Password Hash Synchronization and left additional optional features such as Exchange hybrid, writeback and directory extensions disabled.

Context: The goal was an initial identity sync pilot, not Exchange hybrid, group writeback, device writeback or advanced directory extension work.

14. Configuration Reviewed Before Commit

I reviewed the final configuration before committing changes. The option to start synchronization immediately after configuration was left unchecked.

Context: Leaving automatic sync disabled allowed a final review before manually enabling the scheduler and starting the initial synchronization cycle.

15. Entra Connect Configuration Completed

The wizard completed successfully and warned that synchronization remained disabled until explicitly enabled.

Context: This confirmed the configuration was installed successfully while preserving control over the first synchronization cycle.

16. Pilot Users Moved into the Sync OU

I moved the selected pilot users into the Nietz Ltd\Hybrid Pilot\Users OU so they were inside the OU filtering scope before the first sync cycle.

Context: OU filtering only synchronizes objects inside the selected OU scope, so moving pilot users into this OU made the test deliberately limited and auditable.

17. Pilot User Group Membership Checked

I checked the AD group membership for Kate Jones and Chloe Bennett to confirm they were still in the expected pilot groups before the initial sync.

Context: This validation confirmed the pilot users still had the intended security group memberships after being moved into the synchronization OU.

18. Initial Synchronization Started

I imported the ADSync PowerShell module, enabled the scheduler, confirmed the scheduler state and started an initial sync cycle.

Context: The manual initial sync confirmed the configuration could be started deliberately after the setup review.

19. Pilot User Validated in Microsoft Entra ID

I validated that Kate Jones appeared in Microsoft Entra ID with on-premises sync enabled and on-premises attributes populated.

Context: This was the primary pilot user validation. The row shows [email protected], on-premises sync enabled, SAM account k.jones and domain corp.nietz.co.uk.

20. Pilot Groups Validated in Microsoft Entra ID

I searched for the GRP_HYB groups in Microsoft Entra ID and confirmed all three pilot groups were present with source Windows Server AD.

Context: Group source data confirms the groups were synchronized from on-premises AD rather than being manually created as cloud-only groups.

21. Pilot Issue Raised in ServiceNow

During validation, a duplicate Chloe Bennett identity was identified. I treated this as a pilot finding, paused wider rollout, and raised a ServiceNow incident for follow-up investigation.

Context: This keeps the lab realistic. The sync pilot succeeded for Kate Jones and the pilot groups, but a duplicate identity was found and documented for a separate troubleshooting workflow before wider rollout.

Validation

The technical validation was successful. SYNC1 was domain joined, could resolve and contact DC1, and was placed into the Hybrid Pilot device scope. Microsoft Entra Connect Sync was installed on SYNC1, connected to corp.nietz.co.uk, and configured with OU filtering limited to the Hybrid Pilot OU.

After the initial sync, Kate Jones appeared in Microsoft Entra ID with on-premises sync enabled, and the three GRP_HYB pilot security groups appeared with source Windows Server AD. A duplicate Chloe Bennett identity was identified during validation and documented in ServiceNow as INC0010074 for separate remediation.

Key Technical Outcomes

This lab demonstrated a controlled Entra Connect deployment using a dedicated sync server, AD-based pilot scoping, Password Hash Synchronization, OU filtering, manual initial sync control and Entra-side validation.

It also demonstrated pilot governance. The rollout was not treated as finished simply because the first sync succeeded. A discovered identity issue was recorded as an incident so it can be investigated before expanding synchronization scope.