9. If you don't have a registered domain, you can check the box "Continue without matching all UPN suffixes to verified domains."

Note: The checkbox “Continue without matching all UPN suffixes to verified domains” in Entra Connect Sync allows you to proceed even though your on-premises UPN suffix (antusnet.ca in this case) is not yet verified in your Azure/Entra tenant.

*

10. In this case, antusnet.ca is a registered domain, so it was successfully verified.

*

11. In this demo, I will sync all OUs; however, you can choose specific OUs to sync if needed.

*

12. On the "Uniquely Identifying Your Users" page, if you have only one domain without replication, leave the defaults and click "Next."

Note: On the "Uniquely Identifying Your Users" page, select how Azure AD identifies your users, usually leave the defaults if you have a single domain without replication.

*

13. On the "Filter users and devices" page, choose "Synchronize all users and devices" and click "Next."

*

14. On "Optional feature page," leave defaults and click "Next."

Note: On the "Optional Features" page, you can enable additional options like password sync, pass-through authentication, device writeback, and Exchange hybrid attributes, depending on your environment needs.

Important

Cloud Changes and Writeback:

Requirements for Device Writeback: Microsoft Entra ID P1 or Microsoft Entra ID P2 license.

By default, Azure AD sync is one-way (on-premises → cloud). To allow changes made in Azure to sync back to on-premises, enable writeback features such as password writeback, user writeback, or group writeback. Without these, Azure AD changes will not affect on-premises AD.

Note: 

1. SSPR (Self-Service Password Reset) without Password Writeback

• Only password changes on-premises are synced to Azure AD.
• Users can change their password in Active Directory, and it updates in Entra ID.
• But if a user tries to reset their password directly in Azure Entra ID, it won’t update on-prem AD.
• This is why it’s “one-sided” — cloud resets don’t flow back to the on-prem environment.
• Users may still need helpdesk support if they forget passwords and can’t reset themselves in the cloud.

2. SSPR with Password Writeback enabled

• Password changes and resets in Azure AD are written back to on-prem AD.
• Users can reset passwords from anywhere, including from the cloud portal or mobile.
• Reduces helpdesk tickets because users can self-service both cloud and on-prem accounts.
• Requires Entra ID Premium P1 or P2 license.
• Users must be properly enrolled in SSPR (register authentication methods).

*

15. After it verifies all required components, click "Install."

*

16. The configuration succeeded!

Note: It’s common for the configuration to fail the first time, even if everything is set up correctly. Simply run it again, and it should succeed.

*

17. Confirm that users have been synchronized from on-premises to Azure.

Enabling the filter "On-Premises Sync Enabled" will show only users synchronized from on-premises.

Note: All on-premises users will have their User Principal Name (UPN) as user_name@antusnet.ca, and On-Premises Sync will be enabled.

*

Log in to Azure as a synchronized user using on-premises credentials.

1. I will log in as HR user Alice.

*

2. The username should be formatted as user_name@domain.com.

*

3. If password hash synchronization or pass-through authentication is enabled, the user can use their on-premises password to log in to Azure AD and any connected services like Office 365, Exchange, Teams, or Intune.

Note: This allows a seamless single sign-on experience without creating separate cloud passwords.

*

Once users are synchronized from on-premises AD to Azure AD, you get several key benefits:

Single Sign-On (SSO) – Users can sign in to both on-premises and cloud resources (Office 365, SaaS apps, Azure services) with the same credentials.

Centralized Identity Management – Manage user accounts, passwords, and attributes in one place (on-premises AD) while syncing changes to Azure AD automatically.

Seamless Access to Cloud Services – Synchronized users can immediately access Azure and Microsoft 365 resources without manual account creation in the cloud.

Password Management – Options like password hash sync or pass-through authentication let users maintain one password across environments.

Conditional Access & Security Policies – Apply Azure AD security features (MFA, conditional access, device compliance) to synchronized users.

Hybrid Deployment Support – Supports hybrid Exchange, Teams, Intune, and other services that rely on Azure AD identities.

Device and Group Writeback – Optional features let devices or groups in Azure AD be written back to on-premises AD for hybrid management.

*

Conclusion

In this guide, you successfully implemented a hybrid identity setup using Microsoft Entra Connect. You verified domain ownership in Azure, installed and configured Entra Connect on a domain-joined server with Password Hash Synchronization and Seamless Single Sign-On enabled, and confirmed that on-premises users were synchronized to Microsoft Entra ID.

Finally, you validated the configuration by signing in to Azure using on-premises credentials, demonstrating a functional hybrid authentication flow.

This configuration provides a foundation for centralized identity management, improved user experience through single sign-on, and future implementation of advanced security features such as Conditional Access, Microsoft Defender for Identity, and hybrid access policies.

*

Written by Kirill.A - Azure & Cybersecurity Consultant at AntusNet