Hybrid identity allows users to sign in with the same credentials to access on-premises and cloud-based applications and resources. There are a few main options to configure hybrid identity for Microsoft 365: Password hash synchronization replicates password hashes from on-premises Active Directory to Azure Active Directory. Pass-through authentication redirects authentication requests to on-premises Active Directory without replicating passwords. Federation uses AD FS to issue security tokens for single sign-on. Azure AD Connect or Azure AD Connect Cloud Sync can be used to configure the connectivity and synchronize on-premises directories with Azure AD. Topologies can involve connecting one or multiple on-premises forests. Rules specify that each Azure AD

1. Hybrid Identify for M365
Simon Angling
Lead Cloud Solutions Architect, Liquid Intelligent Technologies

2. Simon Angling
Lead Cloud Solutions Architect,
Liquid Intelligent Technologies
simon@simonangling.com
http://simonangling.com
25+ years IT experience
MCT since 2007

3. Identityis theNewControl Plane

4. What is Hybrid Identity?
Single sign-on
Self-service
Simple connection
On-premises
Other
directories
Windows Server
Active Directory
SaaS
Azure
Public
cloud
Cloud
Microsoft Azure Active Directory

5. Planning for Hybrid
Decisions, Decisions

6. Chose Authentication Method
• Password hash synchronization (PHS)
• Pass-through authentication (PTA)
• Federation (AD FS)

7. Password Hash vs Pass-Through
AZURE AD PASSWORD HASH
SYNCHRONIZATION (PHS)
AZURE AD PASS-THROUGH
AUTHENTICATION (PTA)

8. Password Hash vs Pass-Through
AZURE AD PASSWORD HASH
SYNCHRONIZATION (PHS)
AZURE AD PASS-THROUGH
AUTHENTICATION (PTA)

10. Azure AD Connect vs AAD Connect Sync
AZURE AD CONNECT
• Connect to LDAP directories
• Support for device objects
• Synchronize customer defined AD
attributes (directory extensions)
• Support for Pass-Through
Authentication
• Device and Group Writeback
• Azure AD Domain Services Support
AZURE AD CONNECT CLOUD SYNC
• Connect to multiple disconnected
on-premises AD forests
• Lightweight agent installation
mode
• Multiple active agents for high
availability
• Max 150,000 object per domain

12. Topology and Setup

13. Azure AD Connect Rules
• AAD Connect instance can sync with a single
AAD Instance and vis versa
• An AD object can be replicated either by
AADCS or one AAD Connect instance

14. Sample Topologies

27. Demo

28. Exchange Hybrid

29. ExchangeHybrid

30. Turn of your last Exchange Server?
• You have migrated all mailboxes and public folders to Exchange Online
• Use AD for recipient management and Azure AD Connect for synchronization
• You don't use/require the on-premises Exchange admin center or Exchange Role-
Based Access Control (RBAC)
• Are comfortable with using only Windows PowerShell for recipient management
• You don't require auditing or logging of recipient management activity
• You are running only one Exchange server and only for recipient management
purposes
• Want to manage recipients without running any Exchange servers.

31. and Discusss…