HomeImplementation

Technical source document

Implementation

Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.

Original GitHub document All documentation

Implementation

Project Status

COMPLETE

Existing Hybrid Identity Architecture

This project uses an existing Microsoft Entra Cloud Sync deployment. The synchronization infrastructure was already operational before this validation project and was not rebuilt.

On-Premises Active Directory

  • Domain: ad.jeremyfontenot.online
  • NetBIOS domain: JFAD
  • Domain Controller: DC01
  • Domain Controller IP: 10.10.20.10
  • Operating System: Windows Server 2022
  • Domain functional level: Windows Server 2016

DC01 provides:

  • Active Directory Domain Services
  • DNS
  • DHCP
  • Kerberos
  • Global Catalog
  • Active Directory Web Services

Microsoft Entra

  • Verified domain: jeremyfontenot.online
  • Synchronization technology: Microsoft Entra Cloud Sync
  • Cloud Sync server: SYNC01
  • SYNC01 IP: 10.10.20.105
  • Operating System: Windows Server 2022

Cloud Sync Scope

Synchronization is intentionally limited to the dedicated organizational unit:

OU=Cloud Sync,OU=JFAD,DC=ad,DC=jeremyfontenot,DC=online

The scope was validated in the Microsoft Entra admin center before performing the controlled identity lifecycle test.

Controlled Test User

A dedicated test identity was created in the Cloud Sync OU:

  • Display name: Cloud Sync Test 01
  • SAM account name: cloudsync.test01
  • UPN: cloudsync.test01@jeremyfontenot.online
  • Enabled: Yes
  • Password expiration: Disabled for the controlled lab account

The account was created on-premises and allowed to synchronize through the existing Cloud Sync configuration.

Attribute Synchronization Test

The on-premises Department attribute was changed to:

Hybrid Identity Lab

The value was first validated in Active Directory and subsequently verified in Microsoft Entra.

Password Hash Synchronization Test

The controlled user's password was changed on-premises.

The change was validated by:

  1. Confirming a new PasswordLastSet timestamp in Active Directory.
  2. Authenticating successfully to Microsoft Entra using the updated password.

No password value was recorded in project evidence.

Security Group Synchronization Test

A controlled Active Directory security group was created:

  • Group: GG-CloudSync-Test
  • Category: Security
  • Scope: Global
  • Location: Dedicated Cloud Sync OU

cloudsync.test01 was added as a direct member.

After the normal Cloud Sync provisioning cycle, Microsoft Entra showed:

  • Source: Windows Server AD
  • Type: Security
  • One synchronized direct user member

Synchronization Intervals Observed

The Cloud Sync configuration reports:

  • Users and Groups provisioning interval: 20 minutes
  • Password Hash Sync interval: 5 minutes

These separate synchronization schedules were accounted for during validation to distinguish expected propagation delay from actual synchronization failures.

Provisioning Agent

The existing agent on SYNC01 was retained.

Agent validation confirmed:

  • Service: AADConnectProvisioningAgent
  • Service state: Running
  • Startup mode: Automatic
  • Microsoft Entra agent status: Active

The agent runs under its existing group Managed Service Account and was not reinstalled or replaced.

Implementation Principle

All lifecycle changes originated in on-premises Active Directory. Microsoft Entra was treated as the synchronized target for the tested identities and attributes.

Existing Cloud Sync infrastructure was preserved throughout the project.