Hybrid identity with Active Directory and Microsoft Entra ID in Azure landing zones

Introduction

Hybrid identity is a foundational component in Azure landing zones, enabling seamless and secure access to resources across both on-premises and cloud environments. By integrating on-premises Active Directory (AD) with Microsoft Entra ID (formerly Azure Active Directory), organizations can provide a unified identity experience for users and applications. This integration supports consistent authentication, authorization, and policy enforcement, which are critical for managing access and ensuring security in hybrid cloud architectures.

This article explores the identity and access management services used in Azure landing zones, the role of hybrid identity, and best practices for implementing and managing hybrid identity solutions.

Identity and access management services in Azure landing zones

Azure landing zones leverage a range of identity and access management (IAM) services to establish secure and manageable environments. Key services include:

• Microsoft Entra ID: The cloud-based identity and access management service that provides authentication and authorization for Azure resources and SaaS applications.
• Active Directory Domain Services (AD DS): The traditional on-premises directory service that manages users, groups, and devices within an organization.
• Microsoft Entra ID Domain Services (Azure AD DS): A managed domain service that provides domain join, group policy, LDAP, and Kerberos/NTLM authentication without the need to deploy domain controllers in Azure.
• Azure AD Connect: A synchronization tool that connects on-premises AD with Microsoft Entra ID, enabling hybrid identity scenarios.

These services work together to provide a comprehensive IAM strategy that supports hybrid cloud deployments and secure resource access.

Azure and on-premises domains (hybrid identity)

Hybrid identity refers to the integration of on-premises identity infrastructure with cloud-based identity services. This integration allows users to use a single set of credentials to access resources both on-premises and in the cloud.

Key components of hybrid identity include:

• Directory synchronization: Synchronizing user identities, groups, and other directory objects from on-premises AD to Microsoft Entra ID using Azure AD Connect.
• Authentication methods: Supporting password hash synchronization, pass-through authentication, or federation with Active Directory Federation Services (AD FS).
• Seamless Single Sign-On (SSO): Enabling users to sign in once and access resources across environments without repeated prompts.
• Conditional Access policies: Applying granular access controls based on user, device, location, and risk signals.

Hybrid identity ensures consistent identity management and security policies across environments, reducing administrative overhead and improving user experience.

Hybrid identity recommendations

When implementing hybrid identity in Azure landing zones, consider the following best practices:

• Use Azure AD Connect for synchronization: Deploy Azure AD Connect to synchronize identities and ensure consistency between on-premises AD and Microsoft Entra ID.
• Choose appropriate authentication methods: Evaluate your organization's security requirements to select between password hash synchronization, pass-through authentication, or federation.
• Implement seamless SSO: Configure seamless single sign-on to enhance user productivity and reduce sign-in friction.
• Apply Conditional Access policies: Use Microsoft Entra ID Conditional Access to enforce access controls based on risk and compliance requirements.
• Monitor and audit identity infrastructure: Regularly review logs and alerts from Microsoft Entra ID and on-premises AD to detect and respond to suspicious activities.
• Plan for disaster recovery and business continuity: Ensure backup and recovery procedures are in place for both on-premises AD and Microsoft Entra ID configurations.

Microsoft Entra ID, Domain Services, and AD DS

Understanding the differences and relationships between Microsoft Entra ID, Azure AD Domain Services, and Active Directory Domain Services is essential for designing hybrid identity solutions.

Service	Description	Use Cases
Microsoft Entra ID	Cloud-based identity and access management service providing authentication and authorization.	Cloud applications, SaaS, device management
Azure AD Domain Services	Managed domain services offering traditional AD features like domain join and group policy.	Lift-and-shift applications, legacy apps
Active Directory Domain Services (AD DS)	On-premises directory service managing users, groups, devices, and policies.	On-premises infrastructure and applications

Azure AD DS enables organizations to lift and shift legacy applications to Azure without re-architecting authentication, while Microsoft Entra ID provides modern identity and access management capabilities.

Microsoft Entra ID and AD DS recommendations

For effective hybrid identity management, consider these recommendations:

• Synchronize identities with Azure AD Connect: Ensure that user identities and credentials are synchronized to maintain a consistent identity across environments.
• Leverage Azure AD DS for legacy applications: Use Azure AD Domain Services to support applications that require traditional domain join and LDAP without deploying domain controllers in Azure.
• Use Microsoft Entra ID as the primary authentication source: Whenever possible, modernize applications to authenticate directly against Microsoft Entra ID.
• Implement strong security policies: Enforce multi-factor authentication (MFA), Conditional Access, and identity protection features in Microsoft Entra ID.
• Regularly update and patch AD DS infrastructure: Maintain on-premises AD health and security by applying updates and monitoring replication.
• Plan for identity lifecycle management: Automate provisioning and deprovisioning of identities to reduce security risks and administrative overhead.

By following these recommendations, organizations can build a robust and secure hybrid identity environment within their Azure landing zones.