A Practical Checklist for Hybrid Identity Troubleshooting

Hybrid identity issues are frustrating because the failure can originate on either side of the sync boundary — on-premises Active Directory or Entra ID — and the error message rarely says which. Working through the same checklist in order, every time, beats guessing.

1. Check Entra Connect sync health first

# On the Entra Connect server
Get-ADSyncScheduler
Start-ADSyncSyncCycle -PolicyType Delta

Look at the sync cycle result in the Entra Connect Health portal (if enabled) or the local sync service event log. A failed sync cycle explains a lot of downstream symptoms that otherwise look unrelated.

2. Confirm the object actually synced

Get-MgUser -UserId "[email protected]" -Property OnPremisesSyncEnabled,OnPremisesLastSyncDateTime

If OnPremisesSyncEnabled is false or the last sync timestamp is stale, the problem is upstream of anything Conditional Access or Intune related — fix the sync before touching anything else.

3. Check device registration state separately from user sync

User sync and device registration (Hybrid Join) are two different pipelines that happen to run on the same server. A healthy user sync says nothing about whether a device is actually registered:

dsregcmd /status

Look at AzureAdJoined and DomainJoined — both should say YES for a properly Hybrid Joined device. If AzureAdJoined is NO, the device never completed registration, regardless of what the user’s sync status looks like.

4. Only then look at Conditional Access sign-in logs

Once sync and device registration are confirmed healthy, the sign-in logs in Entra ID will actually mean something — a Conditional Access failure on a device that isn’t properly registered yet is expected, not a policy bug.

Working top-down like this turns “something is broken with sign-in” into a specific, fixable problem — usually in a few minutes instead of a few hours of guessing.