Microsoft Entra Hybrid Identity & Cloud Sync

Microsoft Entra Hybrid Identity & Cloud Sync

Project Status

COMPLETE

Overview

This project demonstrates a validated hybrid identity implementation using Microsoft Entra Cloud Sync to synchronize selected Active Directory users and groups from an on-premises Windows Server environment to Microsoft Entra ID.

The project focuses on controlled identity lifecycle validation, source-of-authority verification, Password Hash Synchronization, security-group synchronization, provisioning-log analysis, and troubleshooting without rebuilding the existing working Cloud Sync deployment.

Environment

On-Premises

• Active Directory domain: ad.jeremyfontenot.online
• NetBIOS domain: JFAD
• Domain Controller: DC01
• DC01 IP: 10.10.20.10
• Operating System: Windows Server 2022
• Domain functional level: Windows Server 2016

Cloud Sync

• Cloud Sync server: SYNC01
• SYNC01 IP: 10.10.20.105
• Operating System: Windows Server 2022
• Synchronization technology: Microsoft Entra Cloud Sync
• Password Hash Synchronization: Enabled

Microsoft Entra

• Verified domain: jeremyfontenot.online
• Synchronization direction: Active Directory → Microsoft Entra ID

Cloud Sync Scope

Synchronization is intentionally limited to:

OU=Cloud Sync,OU=JFAD,DC=ad,DC=jeremyfontenot,DC=online

This provides a controlled boundary for hybrid identity testing without synchronizing unrelated Active Directory objects.

Validated Capabilities

The project successfully validated:

• Cloud Sync provisioning-agent health
• Dedicated OU scoping
• New user provisioning from Active Directory to Microsoft Entra ID
• On-premises attribute synchronization
• Password Hash Synchronization
• Cloud authentication after an on-premises password change
• Security-group synchronization
• Group-membership synchronization
• Provisioning logs
• Source-anchor correlation
• Source-of-authority behavior
• Provisioning-failure review
• Cloud Sync troubleshooting

Controlled Lifecycle Test

The primary test identity was:

cloudsync.test01@jeremyfontenot.online

The lifecycle test validated:

1. Creation in on-premises Active Directory
2. Placement in the dedicated Cloud Sync OU
3. Provisioning to Microsoft Entra ID
4. Synchronization of the Department attribute
5. Password change on-premises
6. Successful Microsoft Entra authentication with the updated password
7. Membership in GG-CloudSync-Test
8. Security-group and membership synchronization
9. Provisioning-log confirmation
10. Source-anchor and immutable-ID correlation

Source of Authority

For the synchronized objects tested in this project, on-premises Active Directory remained the authoritative identity source.

The identity relationship was validated by correlating:

• Active Directory objectGUID
• Cloud Sync SourceAnchor
• Microsoft Entra on-premises immutable ID
• Provisioning-log source and target identifiers

Synchronization Timing

Observed Cloud Sync intervals:

• Users and Groups provisioning: 20 minutes
• Password Hash Synchronization: 5 minutes

These separate intervals were accounted for during validation and troubleshooting.

Troubleshooting Highlights

During validation, the Cloud Sync agent reported a permissions-related metrics error involving access to the registry key Global.

The provisioning agent gMSA was added to the local Performance Log Users group on SYNC01.

After the agent service restarted:

• the registry-access error did not recur
• the metrics agent initialized successfully
• Cloud Sync remained active
• user synchronization succeeded
• group synchronization succeeded
• Password Hash Synchronization succeeded

The existing Cloud Sync installation was preserved.

Project Documentation

• Architecture
• Implementation
• Validation
• Troubleshooting
• Lessons Learned

Security and Evidence Handling

Portfolio evidence is sanitized.

The project does not publish:

• passwords
• authentication tokens
• session cookies
• private keys
• VPN credentials
• other authentication secrets

Technologies Demonstrated

• Windows Server 2022
• Active Directory Domain Services
• Microsoft Entra ID
• Microsoft Entra Cloud Sync
• Password Hash Synchronization
• Group Managed Service Accounts
• PowerShell
• PowerShell Remoting
• Microsoft Entra provisioning logs
• Hybrid identity troubleshooting

Validation Script

A reusable PowerShell validation script is included at:

scripts/Test-CloudSyncADState.ps1

The script validates the current on-premises source state for:

• cloudsync.test01
• GG-CloudSync-Test
• Direct group membership
• Objects located in the dedicated Cloud Sync OU

The script is designed to be executed against a domain controller with the Active Directory PowerShell module available.

Example execution from the administrative workstation:

Invoke-Command -Session $dc -FilePath ".\scripts\Test-CloudSyncADState.ps1"

The script provides repeatable evidence of the Active Directory state without modifying directory objects.

Interview Explanation

I built and validated a hybrid identity lab using Microsoft Entra Cloud Sync between an on-premises Active Directory environment and Microsoft Entra ID.

The environment uses Windows Server 2022 with a dedicated Cloud Sync server and a scoped synchronization OU. I preserved the existing working Cloud Sync deployment rather than rebuilding it.

For the validation, I created a controlled Active Directory user and confirmed that it provisioned to Microsoft Entra. I then changed a supported on-premises attribute, verified the cloud update, changed the user password on-premises, and validated Password Hash Synchronization by successfully authenticating to Microsoft Entra with the new password.

I also created a security group, synchronized the group and its membership, reviewed provisioning logs, and correlated the Active Directory objectGUID with the Cloud Sync source anchor and the Microsoft Entra immutable ID.

During troubleshooting, I identified a permissions issue affecting Cloud Sync metrics, corrected the gMSA permissions on SYNC01, and validated that the agent remained healthy. I also documented the difference between the 20-minute Users and Groups provisioning interval and the 5-minute Password Hash Sync interval so that normal propagation delay is not mistaken for a failure.

The project demonstrates hybrid identity administration, Active Directory, Microsoft Entra ID, Cloud Sync, Password Hash Synchronization, group synchronization, PowerShell remoting, provisioning-log analysis, and evidence-based troubleshooting.

Resume Bullet

• Built and validated a Microsoft Entra hybrid identity lab using Windows Server 2022 Active Directory and Microsoft Entra Cloud Sync, including scoped user and security-group synchronization, Password Hash Synchronization, attribute lifecycle testing, source-anchor correlation, provisioning-log analysis, gMSA troubleshooting, and PowerShell-based remote administration.

LinkedIn Project Description

Built and validated a Microsoft Entra hybrid identity lab integrating Windows Server 2022 Active Directory with Microsoft Entra ID through Microsoft Entra Cloud Sync.

The project included controlled user provisioning, attribute synchronization, Password Hash Synchronization, security-group and group-membership synchronization, source-anchor correlation, provisioning-log analysis, and PowerShell-based remote administration.

I also troubleshot Cloud Sync agent permissions using event logs, validated the provisioning agent gMSA configuration, and confirmed the difference between the 20-minute Users and Groups provisioning cycle and the separate 5-minute Password Hash Sync cycle.

Technologies used: Windows Server 2022, Active Directory Domain Services, Microsoft Entra ID, Microsoft Entra Cloud Sync, Password Hash Synchronization, gMSA, PowerShell, PowerShell Remoting, and Entra provisioning logs.

Architecture

Project Status

COMPLETE

Hybrid Identity Architecture

This project uses Microsoft Entra Cloud Sync to synchronize selected identities from on-premises Active Directory to Microsoft Entra ID.

Core Components

On-Premises Active Directory

• Domain: ad.jeremyfontenot.online
• NetBIOS: JFAD
• Domain Controller: DC01
• IP address: 10.10.20.10
• Operating System: Windows Server 2022
• Domain functional level: Windows Server 2016

Directory services provided by DC01 include:

• Active Directory Domain Services
• DNS
• DHCP
• Kerberos
• Global Catalog
• Active Directory Web Services

Cloud Sync Server

• Server: SYNC01
• IP address: 10.10.20.105
• Operating System: Windows Server 2022
• Role: Microsoft Entra Cloud Sync provisioning agent host

The Cloud Sync agent runs under an existing group Managed Service Account.

Microsoft Entra ID

• Verified domain: jeremyfontenot.online
• Synchronization direction: Active Directory to Microsoft Entra ID
• Synchronization technology: Microsoft Entra Cloud Sync
• Password Hash Synchronization: Enabled

Synchronization Scope

Cloud Sync is intentionally limited to:

OU=Cloud Sync,OU=JFAD,DC=ad,DC=jeremyfontenot,DC=online

This dedicated OU provides a controlled boundary for synchronized users and groups without broadly synchronizing unrelated Active Directory objects.

Identity Flow

The validated identity path is:

DC01 Active Directory → Dedicated Cloud Sync OU → SYNC01 Microsoft Entra Cloud Sync Agent → Microsoft Entra ID

Password changes follow a separate Password Hash Synchronization process through the same Cloud Sync deployment.

Validated Object Types

The project validated synchronization of:

• User objects
• User attributes
• Security groups
• Group membership
• Password hashes

Source of Authority

For the identities tested in this project, on-premises Active Directory is the authoritative source.

Microsoft Entra receives synchronized identity data through Cloud Sync.

The identity relationship was validated through:

• Active Directory objectGUID
• Cloud Sync SourceAnchor
• Microsoft Entra on-premises immutable ID
• Provisioning-log source and target identifiers

Synchronization Timing

Observed configuration intervals:

• Users and Groups provisioning: 20 minutes
• Password Hash Synchronization: 5 minutes

These are separate processing cycles and should be considered during troubleshooting.

Administrative Access Model

The administrative laptop is not domain joined.

Administration is therefore performed primarily through:

• PowerShell Remoting to DC01
• PowerShell Remoting to SYNC01
• Microsoft Entra admin center

This avoids relying on laptop Kerberos or domain-integrated RSAT functionality.

Design Principle

The architecture preserves the existing working Cloud Sync deployment.

No additional synchronization engine was introduced, and Microsoft Entra Connect Sync was not installed simply to obtain manual delta-sync capability.

Cloud Sync vs. Microsoft Entra Connect Sync

This lab uses Microsoft Entra Cloud Sync rather than Microsoft Entra Connect Sync.

Microsoft Entra Cloud Sync

Cloud Sync uses a lightweight provisioning agent installed on SYNC01.

In this lab it provides:

• Active Directory to Microsoft Entra ID user synchronization
• Security-group synchronization
• Group-membership synchronization
• Password Hash Synchronization
• OU-based scoping
• Cloud-managed provisioning configuration
• Provisioning-log visibility in Microsoft Entra

The observed Users and Groups provisioning interval is 20 minutes.

Microsoft Entra Connect Sync

Microsoft Entra Connect Sync uses the traditional synchronization engine installed on a Windows Server.

A key operational difference relevant to this lab is that Connect Sync supports administrator-triggered synchronization cycles, such as a delta synchronization, whereas the Cloud Sync Users and Groups provisioning job operates on its service-managed schedule.

Connect Sync was not installed in this project because the existing Cloud Sync deployment was already functioning and introducing another synchronization engine was unnecessary for the project objectives.

Design Decision

Cloud Sync was retained because it already met the requirements of this controlled hybrid identity implementation.

The architecture therefore remained:

Active Directory → Microsoft Entra Cloud Sync → Microsoft Entra ID

rather than adding Microsoft Entra Connect Sync solely to obtain manually triggered synchronization cycles.

This preserves the existing working infrastructure and avoids overlapping synchronization engines for the same test objects.

Evidence Manifest

Project Status

COMPLETE

This folder contains sanitized evidence and supporting visuals for the Microsoft Entra Hybrid Identity & Cloud Sync project.

Captured Evidence

1. 02-cloudsync-test01-initial-provisioning.png

2. Initial synchronized user in Microsoft Entra

3. 03-cloudsync-test01-attribute-sync.png

4. Department attribute synchronized to Hybrid Identity Lab

5. 04-cloudsync-test01-password-hash-sync.png

6. Successful Microsoft Entra authentication after on-premises password change

7. 05-cloudsync-group-membership.png

8. Cloud Sync Test 01 synchronized as a member of GG-CloudSync-Test

9. 06-cloudsync-user-provisioning-log.png

10. Successful user import, scope evaluation, and provisioning

11. 07-cloudsync-user-modified-properties.png

12. User attribute and source-anchor processing

13. 08-cloudsync-source-authority.png

14. On-premises synchronization and immutable-ID evidence

15. 09-cloudsync-overview-health.png

16. Healthy Cloud Sync configuration and synchronization counts

17. 10-cloudsync-no-failures.png

18. Final provisioning-log failure review with no results

19. 11-cloudsync-group-provisioning-log.png

    • Successful group provisioning event

20. 12-cloudsync-group-modified-properties.png

    • Group membership/source-anchor processing

21. 13-cloudsync-group-summary.png

    • AD-to-Entra group provisioning summary

22. 14-cloudsync-agent-status.png

    • SYNC01 Cloud Sync agent shown as Active

23. 15-cloudsync-ou-scope.png

    • Dedicated Cloud Sync OU scope

24. 16-cloudsync-group-attribute-mapping.png

    • Group attribute mappings

Supporting Visuals

• 01-cloudsync-architecture.png
• 02-identity-lifecycle.png
• 03-source-anchor-correlation.png
• 04-sync-timing.png
• 05-troubleshooting-flow.png
• 06-validation-summary.png
• 07-cloudsync-vs-connect-sync.png

These visuals summarize only validated Project 2 lab architecture, workflow, timing, troubleshooting, and validation results.

Evidence Note

The original pre-test OU baseline was captured as PowerShell output rather than as a screenshot. No screenshot was fabricated for that step.

Sanitization Requirements

Before publishing evidence, verify screenshots do not expose:

• passwords
• authentication tokens
• session cookies
• bearer tokens
• private keys
• VPN credentials
• recovery secrets
• other authentication secrets

Directory object GUIDs, source anchors, lab UPNs, server names, and lab IP addresses may remain where intentionally used as technical evidence.

Implementation

Project Status

COMPLETE

Existing Hybrid Identity Architecture

This project uses an existing Microsoft Entra Cloud Sync deployment. The synchronization infrastructure was already operational before this validation project and was not rebuilt.

On-Premises Active Directory

• Domain: ad.jeremyfontenot.online
• NetBIOS domain: JFAD
• Domain Controller: DC01
• Domain Controller IP: 10.10.20.10
• Operating System: Windows Server 2022
• Domain functional level: Windows Server 2016

DC01 provides:

• Active Directory Domain Services
• DNS
• DHCP
• Kerberos
• Global Catalog
• Active Directory Web Services

Microsoft Entra

• Verified domain: jeremyfontenot.online
• Synchronization technology: Microsoft Entra Cloud Sync
• Cloud Sync server: SYNC01
• SYNC01 IP: 10.10.20.105
• Operating System: Windows Server 2022

Cloud Sync Scope

Synchronization is intentionally limited to the dedicated organizational unit:

OU=Cloud Sync,OU=JFAD,DC=ad,DC=jeremyfontenot,DC=online

The scope was validated in the Microsoft Entra admin center before performing the controlled identity lifecycle test.

Controlled Test User

A dedicated test identity was created in the Cloud Sync OU:

• Display name: Cloud Sync Test 01
• SAM account name: cloudsync.test01
• UPN: cloudsync.test01@jeremyfontenot.online
• Enabled: Yes
• Password expiration: Disabled for the controlled lab account

The account was created on-premises and allowed to synchronize through the existing Cloud Sync configuration.

Attribute Synchronization Test

The on-premises Department attribute was changed to:

Hybrid Identity Lab

The value was first validated in Active Directory and subsequently verified in Microsoft Entra.

Password Hash Synchronization Test

The controlled user's password was changed on-premises.

The change was validated by:

1. Confirming a new PasswordLastSet timestamp in Active Directory.
2. Authenticating successfully to Microsoft Entra using the updated password.

No password value was recorded in project evidence.

Security Group Synchronization Test

A controlled Active Directory security group was created:

• Group: GG-CloudSync-Test
• Category: Security
• Scope: Global
• Location: Dedicated Cloud Sync OU

cloudsync.test01 was added as a direct member.

After the normal Cloud Sync provisioning cycle, Microsoft Entra showed:

• Source: Windows Server AD
• Type: Security
• One synchronized direct user member

Synchronization Intervals Observed

The Cloud Sync configuration reports:

• Users and Groups provisioning interval: 20 minutes
• Password Hash Sync interval: 5 minutes

These separate synchronization schedules were accounted for during validation to distinguish expected propagation delay from actual synchronization failures.

Provisioning Agent

The existing agent on SYNC01 was retained.

Agent validation confirmed:

• Service: AADConnectProvisioningAgent
• Service state: Running
• Startup mode: Automatic
• Microsoft Entra agent status: Active

The agent runs under its existing group Managed Service Account and was not reinstalled or replaced.

Implementation Principle

All lifecycle changes originated in on-premises Active Directory. Microsoft Entra was treated as the synchronized target for the tested identities and attributes.

Existing Cloud Sync infrastructure was preserved throughout the project.

Lessons Learned

Project Status

COMPLETE

Preserve Working Infrastructure

The existing Microsoft Entra Cloud Sync deployment was already functioning and did not need to be rebuilt.

A key operational lesson from this project was to validate the current state before making changes. The working agent, OU scope, Password Hash Synchronization, and existing synchronized users provided a known-good baseline.

Understand Cloud Sync Timing

Microsoft Entra Cloud Sync uses separate synchronization intervals for different functions.

Observed in this lab:

• Users and Groups provisioning: 20 minutes
• Password Hash Synchronization: 5 minutes

A newly created or modified directory object should not be treated as failed until the expected provisioning interval has been considered.

This distinction prevents unnecessary troubleshooting, restarts, or configuration changes.

Source of Authority Matters

For synchronized identities, on-premises Active Directory remained the authoritative source for the tested attributes.

Changes were made in Active Directory first and then validated in Microsoft Entra.

The source relationship was verified using:

• Active Directory objectGUID
• Base64 source-anchor conversion
• Microsoft Entra on-premises immutable ID
• Provisioning log source and target identifiers

Source Anchors Provide Strong Identity Correlation

The controlled user's Active Directory objectGUID was converted to its Base64 source-anchor representation.

That value matched the Microsoft Entra on-premises immutable ID and the provisioning-log source anchor.

This provided direct evidence that the cloud identity was linked to the intended on-premises AD object.

Password Hash Synchronization Is Independent of User Provisioning Timing

Password Hash Synchronization completed on a shorter cycle than Users and Groups provisioning.

Successful Microsoft Entra authentication after an on-premises password change provided practical proof that Password Hash Synchronization was functioning.

Group Synchronization Includes Membership Relationships

Creating a synchronized group is only part of group lifecycle validation.

This project also confirmed that:

• The security group synchronized to Microsoft Entra
• The user membership synchronized
• Provisioning logs processed the membership relationship
• The group Member property referenced the synchronized user's source anchor

Provisioning Logs Are Essential Troubleshooting Evidence

Provisioning logs provided visibility into:

• Import from Active Directory
• Scope evaluation
• Provisioning into Microsoft Entra ID
• Modified properties
• Source IDs
• Target IDs
• Success or failure status

They were more useful for determining actual synchronization behavior than relying only on portal object visibility.

Service Running Does Not Mean Every Component Is Healthy

The provisioning agent service was Running while the event log still contained performance-counter errors.

Reviewing the agent event log identified a permissions issue affecting the metrics collector.

Adding the provisioning gMSA to the local Performance Log Users group resolved the registry-access error without reinstalling Cloud Sync.

Validate Commands in Their Correct Context

Test-ADServiceAccount returned False when executed on DC01 because the Cloud Sync gMSA was assigned for use by SYNC01.

The result demonstrated the importance of understanding what a validation command actually tests before interpreting its output as a failure.

Do Not Troubleshoot Normal Delay as an Outage

The group initially appeared missing from Microsoft Entra because a Users and Groups provisioning cycle had not yet completed.

The object eventually synchronized successfully after the expected Cloud Sync interval.

The main operational lesson is:

Confirm the synchronization schedule before escalating normal propagation delay into troubleshooting.

Portfolio Evidence Should Be Sanitized

Useful evidence includes:

• AD object properties
• OU scope
• provisioning status
• group membership
• provisioning logs
• source-anchor correlation
• synchronization timestamps
• agent health

Passwords, tokens, authentication secrets, private keys, and other credentials should never be included in portfolio evidence.

Troubleshooting

Project Status

COMPLETE

Cloud Sync Agent Validation

The existing Microsoft Entra Cloud Sync agent on SYNC01 was preserved and not reinstalled.

Validation confirmed:

• Service name: AADConnectProvisioningAgent
• Service state: Running
• Startup mode: Automatic
• Service account: existing gMSA
• Entra agent status: Active
• Outbound TCP 443 connectivity to the Cloud Sync bootstrap endpoint: Successful

gMSA Validation

The provisioning agent runs under:

JFAD\pGMSA_126bbe50$

Active Directory validation confirmed that SYNC01 is authorized to retrieve the gMSA managed password.

A Test-ADServiceAccount command executed from DC01 returned False.

This result was not treated as evidence that the gMSA was broken because Test-ADServiceAccount validates whether the computer executing the command can use the account. The Cloud Sync gMSA is assigned to SYNC01, not DC01.

Performance Counter Permission Issue

The Cloud Sync agent event log initially contained:

• Event ID 12033
• Error indicating access to the registry key Global was denied

The local Performance Log Users group on SYNC01 contained no members.

The Cloud Sync gMSA was added to the local:

Performance Log Users

group.

After the agent service was restarted, the previous registry-access error did not recur and the event log reported:

• Event ID 14013
• Metrics Agent was initialized successfully.

Remaining Performance Counter Event

The agent also logged Event ID 12009 indicating failure to initialize performance counters.

Because:

• the provisioning agent remained Running
• Microsoft Entra reported the agent as Active
• the metrics agent initialized successfully
• user synchronization succeeded
• Password Hash Synchronization succeeded
• group synchronization succeeded
• provisioning logs showed successful processing

the agent was not reinstalled based solely on this event.

Cloud Sync Provisioning Delay

During group synchronization testing, the newly created GG-CloudSync-Test group did not immediately appear in Microsoft Entra.

Initial troubleshooting verified:

• The group existed in Active Directory
• ObjectClass was group
• The group was located inside the configured Cloud Sync OU
• The Cloud Sync job contained a Groups attribute mapping
• OU scope was correct
• The provisioning agent was active
• Outbound connectivity was successful

The Cloud Sync Overview later confirmed that Users and Groups provisioning uses a fixed:

20 minute

interval.

After the expected provisioning cycle completed, the group appeared successfully in Microsoft Entra with its synchronized member.

This behavior was documented as normal propagation delay rather than a synchronization failure.

Provision on Demand Limitation Encountered

A group was tested through the AD-to-Entra Provision on demand interface.

The request returned:

ResourceNotFound

with a message indicating the input entry was not found or was out of scope.

Further inspection of the interface showed that this AD-to-Entra provisioning workflow was operating on user objects.

The group test result was therefore not used as evidence of a failed group synchronization.

Final Health Validation

At the end of testing:

• Cloud Sync configuration: Healthy
• Cloud Sync agent: Active
• Users synchronized: 4
• Groups synchronized: 1
• Password Hash Sync: Enabled
• Provisioning failure filter for the final validation window: No results

Troubleshooting Principle

The environment was troubleshot from observed evidence rather than by reinstalling Cloud Sync or changing scope without cause.

The working synchronization infrastructure was preserved throughout the project.

Validation

Project Status

COMPLETE

Controlled Identity Lifecycle Test

User Provisioning

• Source user: cloudsync.test01
• Source UPN: cloudsync.test01@jeremyfontenot.online
• Source OU: OU=Cloud Sync,OU=JFAD,DC=ad,DC=jeremyfontenot,DC=online
• Microsoft Entra provisioning: Validated
• On-premises sync enabled: Yes

Attribute Synchronization

• Attribute tested: Department
• On-premises value: Hybrid Identity Lab
• Microsoft Entra value: Hybrid Identity Lab
• Result: Validated

Password Hash Synchronization

• Password changed on-premises
• Microsoft Entra authentication succeeded using the updated password
• Result: Validated

Group Synchronization

• Source group: GG-CloudSync-Test
• Group type: Global Security
• Source: Windows Server Active Directory
• Microsoft Entra provisioning: Validated
• Direct synchronized members: 1
• Member: Cloud Sync Test 01

Source Anchor Correlation

• AD ObjectGUID: 1e49a065-aa0d-4415-87d2-ee0ad0f4f1d2
• Calculated source anchor: ZaBJHg2qFUSH0u4K0PTx0g==
• Microsoft Entra on-premises immutable ID matched the calculated source anchor
• Result: Validated

Cloud Sync Health

• Configuration status: Healthy
• Provisioning agent: Active
• Users synchronized: 4
• Groups synchronized: 1
• Users/groups provisioning interval: 20 minutes
• Password Hash Sync interval: 5 minutes
• Provisioning failures in final validation window: None

Overall Result

The controlled hybrid identity lifecycle test successfully validated Active Directory to Microsoft Entra provisioning, attribute synchronization, Password Hash Synchronization, security-group synchronization, membership synchronization, provisioning logs, and source-anchor correlation.

Validation Matrix

Lifecycle Validation Result

The controlled identity lifecycle test is COMPLETE.

The broader portfolio project remains IN PROGRESS until final portfolio presentation material and evidence files are organized and committed.