Guides / microsoft-365
windows-server-ibrido · Chapter 4 of 6
Entra Connect: password hash sync, SSO and OU filtering
It is no longer on the Download Center, the wizard's embedded browser cannot register MFA, and OU filtering is the setting to get right first time.
This is the step that turns two separate directories into one identity. A user created on-premises appears in the cloud, signs in to Microsoft 365 with the same password, and gets a mailbox.
The configuration itself is a wizard with sensible defaults. Three things around it cost time, and two of them happen before the wizard even opens.
Before you start: two things that will block you
Both of these present as authentication failures. Neither is.
Where the installer lives now
There are two products with similar names and it is worth choosing deliberately:
| Cloud Sync | Connect Sync | |
|---|---|---|
| What it is | A lightweight agent | A full server application |
| Runs on | Any domain-joined member | A server, often the DC in a small setup |
| Features | The common cases | Everything, including complex filtering and write-back |
| Multiple forests | Handled natively | Handled, with more configuration |
For a single forest with straightforward requirements, Cloud Sync is the modern lightweight answer. This lab used Connect Sync because it wanted the full feature set visible and configurable rather than abstracted away.
The configuration
Express settings, with two choices made explicitly.
Password Hash Sync. A hash of the password hash is synchronised to the cloud, so authentication can happen against Entra ID without reaching back to the on-premises directory. The alternatives — pass-through authentication, federation — keep authentication on-premises and add moving parts and failure modes. For a small environment, PHS is simpler and more robust: if the domain controller is down, cloud sign-in still works.
Seamless SSO. Domain-joined machines on the corporate network get signed in without typing a password. Free, no infrastructure, worth enabling.
OU filtering: the setting to get right first time
The wizard asks which organisational units to synchronise. The default is everything.
Source anchor: let Azure manage it. It uses ms-DS-ConsistencyGuid, which survives a user being moved between OUs or recreated — unlike the older attribute, which did not, and which produced duplicate cloud accounts when it changed.
Verification
- Start the first synchronisation and wait for it to finish.
- Entra ID → Users: the accounts should be there, marked as synchronised from on-premises.
- Check the UPNs. They should be
@yourdomain, not@tenant.onmicrosoft.com— if they are the latter, the domain was not verified before the sync, or the UPN suffix was not set in Active Directory. - Assign a licence to one user and confirm the mailbox is created in Exchange Online.
Two things about administrative accounts
PIM needs Entra ID P2. Privileged Identity Management — activating a role only when needed, for a limited time — is not in Business Premium, which includes P1. Role assignment is therefore direct and permanent.
That is worth stating plainly rather than discovering later: an account holding Global Administrator holds it continuously, so the number of such accounts and how they are protected matters more than it would in a tenant with P2.