skills.rest
jay-steenbergen
jay-steenbergenCOMMUNITY
Explore all skills by this author →
GitHub

sca-entra-hybrid-identity

Guides learners through installing Entra Connect and syncing on-prem AD users to Entra ID.

2|Updated Jun 1, 2026
Search Tags:#azure#active directory#hybrid identity#directory synchronization#entra connect#password hash sync#upn suffix
One-click install
npx skills add https://github.com/jay-steenbergen/MSSAMentorAgent --skill sca-entra-hybrid-identity-jay-steenbergen
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sca-entra-hybrid-identity
Source: https://github.com/jay-steenbergen/MSSAMentorAgent/tree/main/.github/skills/tracks/server-cloud-admin/sca-entra-hybrid-identity
Command: npx skills add https://github.com/jay-steenbergen/MSSAMentorAgent --skill sca-entra-hybrid-identity-jay-steenbergen

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? New administrators struggle to bridge on-premises Active Directory with Microsoft Entra ID, facing confusing UPN suffix mismatches, sync errors, and unclear authentication flows when setting up hybrid identity for the first time. ## Core Features & Use Cases - Guided Entra Connect Installation: Walks through Express install with Password Hash Sync on a domain controller, including OU filtering to scope synchronization. - Sync Error Diagnosis: Teaches use of Synchronization Service Manager to detect and fix common errors like AttributeValueMustBeUnique and InvalidSoftMatch, including a deliberate break-and-fix exercise. - End-to-End Verification: Confirms hybrid identity works by signing into the Azure portal as a synced user with their on-prem password and assigning RBAC roles. - Use Case: A learner with an existing Windows Server domain controller follows the five phases to sync 10 lab users to their Azure tenant, troubleshoot a duplicate-email sync failure, and sign in as a synced user within about two hours. ## Quick Start Ask the mentor to start the sca-entra-hybrid-identity project to set up Entra Connect and sync my on-prem AD users to Entra ID.

Frequently Asked Questions about sca-entra-hybrid-identity

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I sync on-prem Active Directory users to Entra ID?▼

Install Microsoft Entra Connect on a domain-joined server using the Express path with Password Hash Sync, then scope synchronization to a specific OU. Users appear in the Entra portal as Directory synced within minutes of the initial sync cycle.

How to force a manual Entra Connect sync with PowerShell?▼

Run Start-ADSyncSyncCycle -PolicyType Delta for a fast incremental sync of recent changes. Use -PolicyType Initial only after sync rule changes, since it re-evaluates every object and takes much longer.

Why do synced users get the onmicrosoft.com domain instead of my custom domain?▼

The on-prem UPN suffix must match a verified domain in the Entra tenant. If no match exists, Entra falls back to the default onmicrosoft.com suffix. Verify your custom domain via a DNS TXT record and update user UPNs in AD before syncing.

What causes AttributeValueMustBeUnique sync errors in Entra Connect?▼

This error occurs when two on-prem users share the same proxyAddress or mail attribute. Find the duplicate in Synchronization Service Manager, correct the attribute on one user in AD, then run a Delta sync to resolve it.

Does Entra Connect support pass-through authentication or ADFS in this setup?▼

This project configures only Password Hash Sync with one-way on-prem to Entra synchronization. Pass-through authentication, ADFS federation, and writeback are explicitly out of scope, though PHS covers the majority of real-world deployments.

Related Skills

Explore More Education & Research Skills→
404kidwiz404kidwiz

windows-infra-admin

Automate Windows Server and Active Directory administration with PowerShell.

Community
Advanced
NCLGISANCLGISA

azure-arm

Manage Azure resources via az CLI and Python REST helpers.

Official
Advanced
AcczdyAcczdy
2

building-identity-federation-with-saml-azure-ad

Configures and validates SAML federation between on-prem AD FS and Azure AD.

Community
Advanced
AxxxxxxaaannAxxxxxxaaann

building-identity-federation-with-saml-azure-ad

Establish SAML 2.0 federation between on-premises Active Directory and Microsoft Entra ID.

Community
Advanced