Identity & Endpoint
Hybrid Identity & Endpoint Management
Active Directory synchronization, Hybrid Join, and day-to-day device administration and troubleshooting.
Scope
- Active Directory to Entra ID synchronization (Entra Connect)
- Hybrid Azure AD Join configuration for domain-joined devices
- Device administration through Intune
- Sync and authentication issue troubleshooting
Approach
- Audited the on-premises AD schema and OU structure before configuring sync scope.
- Configured Entra Connect with scoped OU filtering to avoid syncing unnecessary objects.
- Set up Hybrid Join so existing domain-joined devices register correctly in Entra ID.
- Built a troubleshooting routine for common sync and authentication failures.
Context
Most organizations don’t move to the cloud in one step — they run Active Directory and Microsoft Entra ID side by side for a long time. This project covered keeping that hybrid state healthy: identity synchronization, device registration, and the troubleshooting that comes with running both environments at once.
What this involved
Entra Connect handled synchronization between on-premises Active Directory and Entra ID, configured with scoped organizational unit filtering so only relevant objects synchronize. Domain-joined devices were configured for Hybrid Azure AD Join, which lets them authenticate against Entra ID while remaining domain members — a prerequisite for several Conditional Access and Intune scenarios.
Day-to-day work included managing devices through Intune and resolving the sync and authentication issues that inevitably surface in hybrid environments — stale device records, duplicate attribute values, and token or certificate issues on the client side.
Approach
Hybrid identity problems are rarely obvious from a single error message — they usually require checking both the on-premises and cloud sides of the picture. The troubleshooting approach here was to build a consistent checklist (sync status, device registration state, certificate validity, Conditional Access sign-in logs) rather than treating each incident as a one-off.