Not Ready to Retire the Domain Controller? Hybrid Identity Explained

You do not have to retire your domain controller to use Microsoft 365 properly. Hybrid identity keeps on-premises Active Directory as the source of truth and gives staff one username and password for both the office network and the cloud.

Many Philippine organisations sit in the middle: email and files have moved to Microsoft 365, but a payroll system, a document management system, file servers or office printers still authenticate against the domain. Hybrid identity is how you run both without asking staff to remember two sets of credentials, and without asking IT to manage two directories.

The short answer

A synchronisation tool copies users and groups from Active Directory to Microsoft Entra ID, the identity service behind Microsoft 365 (formerly called Azure Active Directory). You keep creating, changing and disabling accounts in Active Directory as you do today, and those changes flow to the cloud. Staff sign in to Microsoft 365 with the same credential they use at their desk. When your remaining applications no longer need the domain, you can move to cloud-only identity at your own pace.

Why many organisations are not ready for cloud-only

Moving identity entirely to the cloud is the long-term direction for most businesses, but it depends on every system that relies on the domain having somewhere else to go. The common blockers are familiar:

• Line-of-business applications that sign users in with Windows authentication or a directory lookup, and that the vendor has not yet updated.
• File servers and shared drives whose permissions are built on Active Directory groups.
• Domain-joined computers managed with Group Policy, sometimes for years.
• Printers, scanners and Wi-Fi that authenticate staff against the domain.

None of these is a reason to delay Microsoft 365. They are reasons to connect the two directories properly rather than run them side by side.

What hybrid identity actually does

Without it, an organisation that adopts Microsoft 365 often ends up with two separate lists of people: one on the domain, one in the cloud. Every joiner is created twice, every leaver has to be disabled twice, and passwords drift apart. Sooner or later, an account that was closed on the domain is still open in the cloud.

With hybrid identity, there is one list. Active Directory remains in charge, and Microsoft Entra ID receives a synchronised copy. Disable a leaver in Active Directory and their Microsoft 365 access follows. Add someone to a group and the cloud sees the change. One credential, one directory to administer.

Choosing how people sign in

Hybrid identity offers three ways to check a password when someone signs in to Microsoft 365:

• Password hash synchronisation. A hash of the password hash is synchronised to the cloud, and Microsoft Entra ID checks sign-ins itself. It needs no extra on-premises servers and is the simplest to run.
• Pass-through authentication. Microsoft Entra ID passes the password check to lightweight agents on your network, which validate it against Active Directory. On-premises account states such as lock-outs and sign-in hours apply at the moment of sign-in.
• Federation. Sign-in is handed to an on-premises federation service such as AD FS. It suits a narrow set of requirements but brings the most infrastructure to maintain.

Whichever you choose, Microsoft's own guidance is to enable password hash synchronisation as well. If your on-premises servers are unavailable, through a power failure or a ransomware incident, staff can still reach email and files in the cloud. It also allows Microsoft to warn you when credentials belonging to your users appear in known leaks.

Two synchronisation tools

Microsoft offers two tools for the synchronisation itself. Microsoft Entra Connect Sync, formerly Azure AD Connect, is installed on a server in your environment and supports the widest range of scenarios. Microsoft Entra Cloud Sync uses lightweight agents and is configured from the cloud, which makes it simpler to deploy and keep running.

Microsoft has been steering organisations towards Cloud Sync for new deployments, but some scenarios still depend on Connect Sync, including certain device and multi-forest configurations and advanced filtering. The right choice depends on what your environment needs today, so map the features you rely on before picking one.

A practical rollout sequence

1. Clean the directory first. Remove stale and duplicate accounts, and make sure each user's sign-in name matches their email domain. What you synchronise is what you will live with in the cloud.
2. Decide the sign-in method and confirm password hash synchronisation is part of the design.
3. Scope the synchronisation to the organisational units and groups that matter, rather than the whole directory.
4. Pilot with a small group and confirm sign-in, mail and file access before widening it.
5. Enforce multifactor authentication and block legacy sign-in in the cloud. A synchronised password is still only a password.
6. Add self-service password reset with password writeback if you want staff to reset their own password from anywhere.
7. Join devices to both directories where it helps, so domain-joined PCs can also be managed and protected from the cloud.
8. Monitor synchronisation health and keep the sync components patched.

Security points that are easy to miss

The synchronisation server or agent sits between your domain and your cloud tenant, so treat it with the same care as a domain controller: restricted administrative access, current patches and no other roles on the same machine.

Keep powerful roles separate. Microsoft 365 administrator accounts are best created as cloud-only accounts protected with strong multifactor authentication, and privileged on-premises administrator accounts should not be synchronised at all. That way, a compromise on one side does not hand an attacker the other.

Finally, remember that offboarding now starts in Active Directory. If leavers are removed promptly there, the cloud follows. Our article on Microsoft 365 offboarding gaps covers what else to check when someone leaves.

The path to cloud-only

Hybrid identity is often a long stage rather than a permanent state. As applications are replaced or updated, file shares move to SharePoint and OneDrive, and PCs are managed from the cloud, the reasons to keep the domain fall away one by one.

Microsoft has also been adding the ability to move synchronised objects, starting with groups, from Active Directory management to cloud management one at a time. That makes the final step a gradual handover rather than a single risky cutover. When the last dependency is gone, synchronisation can be switched off and the domain controllers retired.

Frequently asked questions

Is Azure AD Connect the same as Microsoft Entra Connect?

Yes. Microsoft renamed Azure Active Directory to Microsoft Entra ID, and Azure AD Connect became Microsoft Entra Connect. The purpose is unchanged: synchronising on-premises Active Directory with the identity service behind Microsoft 365.

Will staff need a new password?

No. With hybrid identity, staff keep the username and password they already use on the office network and use the same credential for Microsoft 365.

What happens to Microsoft 365 if our domain controller goes down?

If password hash synchronisation is enabled, staff can continue to sign in to cloud services while on-premises systems are restored. This is the main reason Microsoft recommends enabling it even when another sign-in method is used.

Do we need hybrid identity if all our applications are in the cloud?

Probably not. If nothing still authenticates against the domain, cloud-only identity is simpler to run. Hybrid identity is for organisations that still have systems depending on Active Directory.

Can we move to cloud-only later?

Yes. Hybrid identity keeps that path open. You can retire domain dependencies one application at a time and switch off synchronisation once nothing relies on it.

Where to start

Begin with an inventory of what still authenticates against your domain and how clean your directory is. Those two answers shape every other decision. Onprem2Cloud IT Solutions Co. is a Microsoft CSP partner based in Muntinlupa City, Metro Manila, working with businesses, local government units and national agencies. See our Azure Active Directory hybrid service, or contact us to plan yours.

If you are tightening sign-in at the same time, our article on enforcing multifactor authentication in Microsoft 365 explains the gap most tenants still have.