Hybrid Identity with Windows AD and Azure AD (Entra ID)

In this section, we continue to explore Microsoft Azure AD. We add a custom domain name to Azure AD and then review access control for Azure AD. We then dig deep into what makes up a Hybrid Identity, and use Azure AD Connect Sync to establish Hybrid Identities between Windows AD and Azure AD.

Azure AD is setup with an “onmicrosoft.com” default domain provisioned when the first subscription in a tenant is created. This lecture goes over adding a custom domain to an Azure AD tenant, and how to change the default domain to the custom domain.

This lab walks through the steps of adding a custom domain to the Azure AD tenant and configuring external DNS to validate the domain. Next, a new user is added with the custom domain to verify functionality.

Azure AD is a cloud native identity service and not all organizations require a Hybrid Identity solution. In this lecture, we review how to manage Azure AD users, groups and permissions in a cloud native environment

This lab walks through he steps to add users and groups with the Azure Portal and then assign RBAC roles to a user. We use the Global Reader role and verify access by logging in with a cloud-native account.

Azure AD can be used on its own, but many companies with existing Windows Active Directory Domain Services will take a hybrid approach; extending on-premises identities into Azure. This lecture reviews how Hybrid Identity is implemented in Azure, including options to manage passwords to maintain a unified identity between Windows AD and Azure AD.

All users require unique user name on a network. In Windows AD, that name is referred to as a User Principal Name (UPN). In this lecture, we examine the UPN and how to address UPN's that won't work in Azure AD.

We need identities to synchronize in upcoming labs. In this lab, we start by creating users in Windows AD to use for the upcoming lab. After that, we add an alternate UPN suffix.

In this lab, we run IDFix and correct errors with Windows AD before we sync identities to Azure AD.

This lecture starts with an introduction to Azure AD Connect. After that, we move on to common implementation scenarios and options for deploying Azure AD Connect for Hybrid Identities.

Azure AD Connect Clouds Sync is another option for synchronizing identities from a Windows AD to Azure AD. In this video, we the compare similarities and differences of Cloud Sync and when to use one option over the other.

Our environment is now prepared, it’s time to deploy Azure AD Connect Sync. We start by enabling prerequisites, create a new Global Admin account used for the Azure AD Connect Sync installation. After that, we install Azure AD Connect Sync and test functionality by logging in with a hybrid account.

This lecture summarizes what we have learned in this section.

Now that we have Hybrid Azure AD Identities in place, it's time to move on to common management and monitoring tasks, as well as configuration settings to make the most out of Azure AD.

This lecture reviews the different ways to enable a trial Azure AD Premium license on the Azure AD tenant, or purchase a premium license if one is not available.

Microsoft enables a set of security defaults to all new Azure AD tenants. This lab reviews what they are and how to disable them for greater control of the Azure AD tenant.

This lab goes over the steps to register an account for MFA when security defaults are enabled. Then, we disable Security Defaults on the tenant to prepare the environment for the upcoming labs.

In this lab, we add company branding, technical contacts for notifications, and company privacy information to the portal.

This lecture introduces the concept of Azure AD Registered and Joined devices, outlining the differences between the two. The lecture reviews how Azure AD Hybrid Join works in an environment with Windows AD replicating to Azure AD.

This lab is a prerequisite for the next on Azure AD Hybrid Join. In this lab, we deploy a Windows client and join it to the domain. We also review how to register client to Azure AD.

In this lab, we enable the hybrid test accounts to log into the Windows client computer remotely. Next, we verify that single sign-on is working for the users.

Our environment supports single sign-on after configuring Hybrid Azure AD join. In this lecture, we review what takes place for SSO to function.

This lecture gives an overview of Multi-Factor Authentication (MFA) and the options to enforce MFA on individuals in the organization.

There are multiple ways to enforce MFA in Azure AD. This lab looks at enforcing MFA per-user. We also explore settings available for MFA in the Azure AD tenant.

Microsoft recommends using Conditional Access Polices over Per-User to enforce MFA. This lecture provides an overview of Conditional Access Policies.

This lab starts by disabling the per-user MFA settings from the previous lab. We then create an emergency access account to prevent accidently locking ourselves out in the upcoming lab.

In this lab, we create a conditional access policy to enforce multi-factor authentication when logging in from outside a trusted network.

Self-service password resets (SSPR) allow users to reset their password without the help of IT support. This feature is possible with the AD Connect Password Writeback feature. This lecture reviews the feature and how to enable it and enroll users to use the service.

In this lab, we walk through the process of enabling self-service password reset and then test the process with a user account.

Weak passwords are a threat to any organization’s security posture. Windows Active Directory can enforce password length and complexity, but that alone may not prevent “simple to guess” passwords such as “P@ssword123”. Password Protection for Windows Server Active Directory is a cloud-hosted service that extends to on-premises servers; this prevents weak passwords based on a banned password list. This lab reviews the functionality of Password Protection for Windows Server Active Directory as well as the licensing requirements for the product.

This lab goes over the steps to install the Azure AD Password Protection proxy and agent on the on-premises network. It also reviews the steps to enable and test Azure AD Password Protection.

Maintaining a healthy AD DS environment is important to the integrity of an Azure AD hybrid environment. This lecture introduces the Azure AD Connect Health. A tool for collecting health data from AD DS and Azure AD Connect and reporting on it in the Azure portal. This lecture reviews the requirements and configuration options of Azure AD Connect Health.

In this lab, we deploy the Azure AD Connect Health agent for Windows AD DS, configure alerts and review information in the Azure AD Connect Health portal.

The Azure AD Connect Sync Express Settings work well for most environments, but others may want to limit what is synchronized with Azure AD. In this lecture, we review how to apply source filters in Azure AD Connect Sync to limit what is synchronized to Azure AD.

This lab walks through the process of creating filters based on OU and an object attribute. We also take steps to verify the change prior to putting it into production.

Security is important to any Azure AD implementation. Azure AD has several options available for monitoring security in Azure AD. This lecture will review the options available with each version of Azure AD.

This is a summary of the information covered in this section.