Introduction to Hybrid Infrastructure

In this session of the advanced Microsoft 365 course, we move from self‑service password reset (SSPR) and multi‑factor authentication to building a hybrid infrastructure. The focus is on synchronizing on‑premises Active Directory (AD) users to Azure Active Directory (Azure AD) using Azure AD Connect V2. This tool works with Windows Server 2016, 2019, and 2022 and enables hybrid mail services and migration scenarios.

Prerequisites for a Successful Deployment

Before installing Azure AD Connect, two main prerequisites must be satisfied:

• Office 365 side – Create an Azure AD user that is a member of the Global Administrator role. This account will be used during the Azure AD Connect wizard.
• On‑premises side – Download the Azure AD Connect tool (approximately 146 MB) and install it on a server that hosts Active Directory Domain Services (AD DS). The server must have an Enterprise Administrator account for AD DS.

A minimum internet bandwidth of 20 Mbps is recommended to ensure smooth synchronization.

Synchronization Protocols and Core Services

Azure AD Connect relies on HTTPS and the Service Bus to exchange data securely between the on‑premises AD and Azure AD. The tool provides several core services:

• Password Hash Synchronization – Copies password hashes to Azure AD.
• Password Write‑Back – Allows password changes in Azure AD to be written back to on‑premises AD.
• Pass‑Through Authentication – Validates passwords against the on‑premises AD in real time.
• Single Sign‑On (SSO) – Enables users to sign in once and access both cloud and on‑premises resources.
• SSO with ADFS – Extends SSO using Active Directory Federation Services.
• Custom User Synchronization – Lets administrators select specific objects for sync.
• Custom UPN Suffixes / Alternate UPN Suffixes – Supports non‑standard user principal names.

Practical Implementation Steps

1. On‑Premises Domain Controller Setup
2. A virtual machine was created in VMware Workstation running Windows Server 2016.
3. The domain was named cloud.com.

4. Three test users—Tata, Telnet, and Cloud—were added to AD DS.

5. Office 365 Portal Preparation

6. In the Microsoft 365 admin center, the instructor navigated to Azure AD → Users → All users.
7. Existing demo users were deleted to start with a clean slate.

8. A Global Administrator account [email protected] was created.

9. Azure AD Connect Installation

10. The Azure AD Connect V2 installer (≈146 MB) was downloaded and launched.
11. The Global Administrator credentials ([email protected]) were entered.
12. Enhanced security was turned off when prompted.
13. The on‑premises Enterprise Administrator credentials were supplied.
14. Because the on‑premises domain cloud.com was not verified in Azure AD, the wizard displayed “Continue without matching UPN suffix.” This option was selected, allowing the sync to proceed despite the missing custom UPN suffix.
15. The installation completed after the required checks.

Verification of Synchronization

After Azure AD Connect finished, the instructor opened dsa.msc on the domain controller to confirm the presence of the three on‑premises users. In the Azure AD portal, the same users appeared, but each was associated with the default onmicrosoft.com domain. This outcome occurs when a custom UPN suffix is not configured or matched between the on‑premises AD and Azure AD.

The demonstration confirms that Azure AD Connect V2 can successfully synchronize on‑premises identities to Microsoft 365, even when the on‑premises domain is not yet verified in Azure AD.