Category: Directory Services

Microsoft Entra Connect

Also known as: Entra Connect, Azure AD Connect

Simply put

Microsoft Entra Connect is an on-premises Microsoft application that links an organization's local Active Directory with Microsoft Entra ID (Microsoft's cloud identity service). It synchronizes identity information between the two so that users and their accounts can be recognized consistently across on-premises and cloud environments. This helps organizations achieve what Microsoft calls hybrid identity goals.

Formal definition

Microsoft Entra Connect is an on-premises Microsoft application that integrates on-premises Active Directory with Microsoft Entra ID to support hybrid identity scenarios. It acts as a synchronization bridge that provisions and reconciles identity data between the on-premises directory and Entra ID; the specific synchronization behavior, authentication options, and installation paths depend on how the tool is configured and installed. According to the evidence, it is deployed and installed on-premises, with installation options documented in Microsoft's Entra Connect installation roadmap. The evidence does not detail the specific protocols, sync engine internals, or authentication methods (for example, password hash synchronization versus pass-through authentication), so those aspects are out of scope for this definition.

Why it matters

Most enterprises that adopt Microsoft's cloud identity service do not start from a clean slate; they operate an existing on-premises Active Directory that already governs employee accounts, groups, and access. Microsoft Entra Connect matters because it is the component that reconciles these two worlds, allowing the same user identities to be recognized consistently across on-premises and cloud environments. Without such a synchronization bridge, organizations would face duplicate identities, inconsistent account states, and manual reconciliation between directories, which increases both administrative burden and the risk of orphaned or mismatched accounts.

Because Entra Connect sits at the boundary between on-premises Active Directory and Entra ID and moves identity data between them, it is a high-value part of the identity infrastructure. Its configuration determines how identity information flows across environments, which makes correct installation and ongoing operation an important concern for security architects and administrators. The evidence does not detail specific authentication methods or sync engine internals, so claims about particular security properties or failure modes tied to those mechanisms are out of scope here; teams should evaluate them against Microsoft's own documentation for their chosen configuration.

For identity governance and operational teams, the practical significance is that Entra Connect underpins hybrid identity scenarios, the coexistence of directory-based on-premises identity and cloud identity. Any organization pursuing what Microsoft calls hybrid identity goals typically depends on this tool functioning correctly, and changes to its configuration can have broad downstream effects on which accounts exist and how they are represented in the cloud.

Who it's relevant to

IAM Engineers and System Administrators

Teams responsible for deploying and maintaining hybrid identity typically own the installation and ongoing operation of Entra Connect. Because it is installed on-premises with multiple installation paths documented in Microsoft's roadmap, these practitioners must choose an appropriate configuration and ensure the synchronization bridge continues to reconcile identity data reliably between Active Directory and Entra ID.

Security Architects

Architects designing hybrid identity environments need to account for Entra Connect as the component that links on-premises Active Directory with Entra ID and moves identity data across that boundary. Its placement and configuration influence how identities are represented consistently across on-premises and cloud environments, which is a foundational design consideration.

Identity Governance and Administration Leads

Because Entra Connect provisions and reconciles identity data between directories, governance teams concerned with the accuracy and consistency of accounts across environments depend on it functioning correctly. Note that lifecycle governance activities such as access reviews and certification are separate concerns from the synchronization the tool performs.

Compliance and Audit Teams

Auditors reviewing hybrid identity deployments have an interest in how identity data flows between on-premises Active Directory and Entra ID and how the synchronization tool is installed and configured, since this affects the consistency and integrity of identity information across the organization's environments.

Inside Microsoft Entra Connect

Synchronization service (sync engine)

The core component that reads objects from on-premises Active Directory and writes corresponding objects to a cloud identity tenant. It orchestrates import, synchronization, and export operations against configured connectors, and applies the transformation rules that determine how source attributes flow to the target directory.

Connectors

Configured links to source and target directories, typically an on-premises Active Directory connector and a connector to the cloud tenant. Each connector defines how objects are read from and written to its directory, and depending on configuration multiple forests can be connected.

Attribute flow and synchronization rules

The rule sets that map and transform source directory attributes into target directory attributes. These rules govern object scoping (which objects sync), joining of objects across connectors, and precedence when multiple rules apply. This is a provisioning/lifecycle concern, distinct from runtime access enforcement.

Password hash synchronization (PHS)

An authentication option in which a hash of the on-premises password hash is synchronized to the cloud tenant so users can authenticate against the cloud directory with the same password. Note this is one of several sign-in options; whether it is enabled depends on deployment choices and is separate from authorization decisions made after sign-in.

Pass-through authentication (PTA)

An alternative sign-in option in which authentication requests are validated against on-premises Active Directory in real time via lightweight agents, so password hashes are not synchronized to the cloud. It addresses where credential verification occurs, not what a user is subsequently authorized to do.

Federation integration

A configuration option that defers authentication to a federation provider (for example AD FS) rather than validating credentials in the cloud tenant. In this mode Entra Connect still handles object synchronization while authentication is handled by the external federation service.

Metaverse and connector spaces

The internal staging model where each connector has a connector space representing its view of a directory, and the metaverse holds the consolidated, joined representation of objects. Attribute flow moves data between connector spaces and the metaverse before export.

Filtering and scoping configuration

Controls that limit which organizational units, domains, or objects are included in synchronization. Proper scoping determines the boundary of what identity data leaves the on-premises environment.

Common questions

Answers to the questions practitioners most commonly ask about Microsoft Entra Connect.

Does Entra Connect authenticate users against Microsoft Entra ID?

Not by itself. Entra Connect is a synchronization and provisioning tool that reconciles identity data between an on-premises Active Directory and Microsoft Entra ID. Whether authentication actually occurs against Entra ID depends on the sign-in method you configure. With password hash synchronization, a hash of the password hash is synced so Entra ID can validate credentials; with pass-through authentication, validation is delegated back to on-premises AD via agents; and with federation, authentication is handled by a separate federation service. Entra Connect provisions and updates the identity objects, but it should not be conflated with the authentication step itself, which is governed by the chosen configuration.

Is Entra Connect the same thing as an identity federation or SSO protocol?

No. Entra Connect is a provisioning and directory synchronization component; it is not a federation standard such as SAML 2.0 or an authentication layer such as OpenID Connect. Federation, when used, is typically provided by a separate service that Entra Connect can be configured to work alongside. Treating Entra Connect as an SSO protocol blurs the distinction between identity lifecycle synchronization (an administration concern) and runtime authentication and token issuance (an enforcement concern), which are separate steps.

Which sign-in method should be selected when configuring Entra Connect?

The choice among password hash synchronization, pass-through authentication, and federation typically depends on your requirements for where credential validation must occur, tolerance for on-premises dependencies, and any regulatory or architectural constraints. In most deployments, password hash synchronization minimizes on-premises infrastructure, while pass-through authentication and federation keep validation closer to on-premises AD at the cost of additional components. Because behavior and trade-offs vary by deployment context, evaluate availability, latency, and compliance needs rather than assuming one method is universally preferable. The specifics are configuration-dependent.

How does Entra Connect determine which objects and attributes are synchronized?

Synchronization scope is governed by configuration such as organizational unit and domain filtering, attribute filtering, and synchronization rules. Depending on configuration, you can restrict which users, groups, and other objects are provisioned and which attributes flow to Entra ID. Because incorrect scoping can provision or omit objects unexpectedly, scope decisions should be validated before enabling synchronization. The exact filtering options available depend on the version and features in use.

What should be considered for high availability of Entra Connect?

In most deployments, a single active synchronization server handles synchronization, so continuity planning is a common concern. Options such as configuring a secondary server in staging mode are typically available to support failover and testing. If pass-through authentication or federation is used, the availability of their respective agents or services is a separate consideration from the synchronization server itself. Availability behavior and supported topologies depend on the version and deployment; consult current vendor documentation rather than assuming a fixed design.

How can synchronization behavior be validated after configuring Entra Connect?

Validation typically involves reviewing synchronization run results, confirming that in-scope objects and attributes appear as expected in Entra ID, and checking for synchronization errors such as attribute conflicts or duplicate values. Depending on configuration, monitoring and health-reporting features may also be available to surface synchronization and, where applicable, authentication-agent status. Because available tooling and reporting vary by version and licensing, verify current capabilities against vendor documentation.

Common misconceptions

Password hash synchronization uploads users' actual passwords or reversible password material to the cloud.

In most deployments PHS synchronizes a hash derived from the stored on-premises password hash rather than a cleartext or reversible password. It is a credential verification mechanism and does not, by itself, determine what a synchronized user is authorized to access; authorization is evaluated separately after authentication.

Entra Connect performs real-time access enforcement and authorization decisions.

Entra Connect is primarily a provisioning and synchronization tool that handles object lifecycle between on-premises Active Directory and a cloud tenant. Runtime authentication (except where PTA or federation is involved) and authorization decisions are handled by the identity platform and its policy engines, not by the sync process itself.

Choosing password hash sync, pass-through authentication, and federation is an either/all decision with no meaningful difference.

These are distinct sign-in options that differ in where credential verification occurs and what leaves the on-premises environment. Depending on configuration they can address different security and availability requirements, and the appropriate choice varies by deployment context rather than one being universally superior.

Best practices

Scope synchronization deliberately using filtering so that only the required organizational units and objects are synchronized, minimizing the identity data that leaves the on-premises environment.

Select the sign-in option (password hash synchronization, pass-through authentication, or federation) based on where you require credential verification to occur and your availability and security requirements, rather than defaulting to one without evaluation.

Treat synchronization rule customizations as controlled changes: document attribute flow and transformation rules, and validate them in a staging environment before applying to production to avoid unintended object scoping or attribute precedence effects.

Monitor synchronization health and error reporting regularly, since export or join failures can leave provisioned identities in an inconsistent state that affects downstream access.

Keep the sync engine and any authentication agents patched and highly available, deploying redundant agents where pass-through authentication or similar real-time components are in use.

Separate provisioning concerns handled by Entra Connect from downstream governance and access-review processes, ensuring that synchronized accounts are still subject to appropriate certification and segregation-of-duties controls in your governance tooling.