Microsoft Entra Connect - Simply Explained

1
00:00:00,000 --> 00:00:04,000
Today our Tim is knowledge nugget is one that almost everyone in IT has heard of, but

2
00:00:04,000 --> 00:00:05,880
rarely gets a clear explanation.

3
00:00:05,880 --> 00:00:07,640
What exactly is Microsoft AntraConnect?

4
00:00:07,640 --> 00:00:11,080
Is it just another tool with a new name or does it solve a problem you might already

5
00:00:11,080 --> 00:00:12,600
have in your company?

6
00:00:12,600 --> 00:00:17,600
Imagine you sign into your work laptop in the office, then you open Teams Outlook or OneDrive,

7
00:00:17,600 --> 00:00:20,520
and suddenly you need another account or another password.

8
00:00:20,520 --> 00:00:24,240
Or someone in IT has to create you again, same person, but two records somehow.

9
00:00:24,240 --> 00:00:29,040
For years, many companies kept their staff directory inside the building with Active Directory,

10
00:00:29,040 --> 00:00:33,120
while Microsoft 365 used Microsoft Antra ID in the cloud.

11
00:00:33,120 --> 00:00:36,720
Both places needed to know who you were, what your email address was, and whether you

12
00:00:36,720 --> 00:00:38,200
still worked there.

13
00:00:38,200 --> 00:00:41,560
Without a connection between them, people ended up with duplicate accounts.

14
00:00:41,560 --> 00:00:42,880
Password resets took longer.

15
00:00:42,880 --> 00:00:47,640
A new employee could sign into Windows, but still wait for access to Teams or email.

16
00:00:47,640 --> 00:00:50,480
Hero, Tim as the simplest definition.

17
00:00:50,480 --> 00:00:54,720
Microsoft AntraConnect is the controlled bridge between those two identity systems.

18
00:00:54,720 --> 00:00:58,280
By the end of this knowledge nugget, you will understand how that bridge keeps staff records

19
00:00:58,280 --> 00:01:02,560
in sync, how people sign in, and how IT checks whether the connection still works.

20
00:01:02,560 --> 00:01:06,040
Let's start by looking at the two places it connects.

21
00:01:06,040 --> 00:01:10,480
The two identity homes, let's talk to Tim has break it down into the major components.

22
00:01:10,480 --> 00:01:11,480
Start with Active Directory.

23
00:01:11,480 --> 00:01:15,520
Active Directory is the staff directory that many companies keep on their own network.

24
00:01:15,520 --> 00:01:19,840
It usually lives on servers the company manages, often in its own building or data center.

25
00:01:19,840 --> 00:01:22,800
Think of it as the local records room in an office building.

26
00:01:22,800 --> 00:01:26,560
Inside that records room, the company keeps a record for each employee or their name,

27
00:01:26,560 --> 00:01:30,640
job title, department, work email address, and the groups they belong to.

28
00:01:30,640 --> 00:01:33,320
It also helps control access inside the local network.

29
00:01:33,320 --> 00:01:37,200
When you turn on a company Windows laptop and sign in with your work account,

30
00:01:37,200 --> 00:01:39,280
Active Directory may check who you are.

31
00:01:39,280 --> 00:01:43,320
When you open a shared folder for your department, it may decide whether you can enter that folder.

32
00:01:43,320 --> 00:01:46,720
For a long time, this covered most of a company at TM is daily work.

33
00:01:46,720 --> 00:01:50,160
You signed into Windows, used local file shares and printed documents.

34
00:01:50,160 --> 00:01:53,360
Your work account lived mostly inside the company network.

35
00:01:53,360 --> 00:01:58,320
And work moved beyond the building, email shifted to exchange online, meetings moved into teams.

36
00:01:58,320 --> 00:02:02,600
Personal work files landed in one drive and team files started living in SharePoint.

37
00:02:02,600 --> 00:02:06,040
People could work from home, from a client site or from a phone in a coffee shop.

38
00:02:06,040 --> 00:02:08,000
Those cloud services need a directory too.

39
00:02:08,000 --> 00:02:10,280
That directory is Microsoft EntraID.

40
00:02:10,280 --> 00:02:14,600
Microsoft EntraID is the cloud reception desk for Microsoft 365.

41
00:02:14,600 --> 00:02:18,200
When you sign into Teams Exchange Online SharePoint or OneDrive,

42
00:02:18,200 --> 00:02:21,360
EntraID checks your identity and decides whether you can enter,

43
00:02:21,360 --> 00:02:24,840
which are a large office building with a reception desk at the entrance.

44
00:02:24,840 --> 00:02:29,200
The receptionist checks your pass, then the building rules decide which rooms you can use.

45
00:02:29,200 --> 00:02:32,440
You might enter the Teams meeting room, your exchange online mailbox,

46
00:02:32,440 --> 00:02:36,560
or a SharePoint team site, while another person can enter a different set of rooms.

47
00:02:36,560 --> 00:02:38,440
Most users never see this reception desk.

48
00:02:38,440 --> 00:02:42,720
They just type their work, email address and password, then open the app they need.

49
00:02:42,720 --> 00:02:46,280
Behind the scenes, EntraID handles the cloud sign in and cloud access.

50
00:02:46,280 --> 00:02:47,640
So where does the problem appear?

51
00:02:47,640 --> 00:02:51,480
The company might still rely on Active Directory for Windows Sign-ins and local folders,

52
00:02:51,480 --> 00:02:54,560
while also relying on EntraID for Microsoft 365.

53
00:02:54,560 --> 00:02:56,520
That setup is called Hybrid Identity.

54
00:02:56,520 --> 00:03:00,560
Hybrid Identity simply means the company uses both identity homes at the same time.

55
00:03:00,560 --> 00:03:04,960
One sits on the company network and the other sits in Microsoft or TMR's cloud.

56
00:03:04,960 --> 00:03:07,800
Imagine a new employee called Alex joins the company.

57
00:03:07,800 --> 00:03:14,720
HR enters Alex out TMT as details, and IT creates Alex out TMS account in Active Directory.

58
00:03:14,720 --> 00:03:18,400
Alex can now sign into a Windows laptop and reach the right local folders,

59
00:03:18,400 --> 00:03:23,600
but Alex also needs an email mailbox, Teams meetings, OneDrive files and access to SharePoint.

60
00:03:23,600 --> 00:03:28,480
Creating a completely separate cloud account for Alex would create extra work and extra risk.

61
00:03:28,480 --> 00:03:33,720
Someone would need to keep the name, email address, department and account status correct in two places.

62
00:03:33,720 --> 00:03:36,040
That opens how records slowly drift apart.

63
00:03:36,040 --> 00:03:38,520
Alex changes department in one system but not the other.

64
00:03:38,520 --> 00:03:43,040
Alex leaves the company, one account is disabled, and another account still exists.

65
00:03:43,040 --> 00:03:45,920
All Alex forgets which password belongs to which sign in.

66
00:03:45,920 --> 00:03:47,840
EntraConnect keeps the two records linked.

67
00:03:47,840 --> 00:03:50,320
Notice that Alex does appear in two places.

68
00:03:50,320 --> 00:03:52,560
Active Directory and EntraID out.

69
00:03:52,560 --> 00:03:56,720
But those records represent one employee, not two unrelated accounts.

70
00:03:56,720 --> 00:04:00,680
For synced users, Active Directory normally remains the source of authority.

71
00:04:00,680 --> 00:04:05,000
In plain English, that means the local record is the main filing cabinet for details,

72
00:04:05,000 --> 00:04:08,400
such as Alex IOT, Maze, Name, Department and Account Status.

73
00:04:08,400 --> 00:04:11,280
If IT changes Alex IOT, Mates department locally,

74
00:04:11,280 --> 00:04:13,000
that change should travel to the cloud.

75
00:04:13,000 --> 00:04:18,240
Editing the same synced detail directly in EntraID can either fail or get replaced later by the local value.

76
00:04:18,240 --> 00:04:22,840
That sounds strict, but it prevents two filing cabinets from arguing over which record is correct.

77
00:04:22,840 --> 00:04:27,160
EntraConnect moves selected identity information from Active Directory to EntraID.

78
00:04:27,160 --> 00:04:34,480
EntraID then handles access to cloud services such as Microsoft 365, Teams, Exchange Online, SharePoint and OneDrive.

79
00:04:34,480 --> 00:04:37,720
One tool connects the records and the other controls cloud access.

80
00:04:37,720 --> 00:04:42,160
Next we need to see how that bridge decides who and what can cross.

81
00:04:42,160 --> 00:04:44,720
Building block one, Sync.

82
00:04:44,720 --> 00:04:46,240
So here's how this starts.

83
00:04:46,240 --> 00:04:49,920
EntraConnect Sync runs on a Windows server inside the company network.

84
00:04:49,920 --> 00:04:55,920
Picture that server as a guarded bridge office between the local directory and Microsoft EntraID.

85
00:04:55,920 --> 00:04:57,560
It doesn't ask every record to cross.

86
00:04:57,560 --> 00:05:00,440
Instead, it checks the rules, looks for what changed,

87
00:05:00,440 --> 00:05:02,760
and sends only the right information to the cloud.

88
00:05:02,760 --> 00:05:04,120
That control matters a lot.

89
00:05:04,120 --> 00:05:08,320
A local Active Directory has more than just current employees, all test accounts,

90
00:05:08,320 --> 00:05:11,880
service accounts that software uses, disabled accounts, training accounts,

91
00:05:11,880 --> 00:05:14,040
records that only exist for local work-o.

92
00:05:14,040 --> 00:05:15,000
They're all in there.

93
00:05:15,000 --> 00:05:18,120
Most companies don't want all of that inside Microsoft 365.

94
00:05:18,120 --> 00:05:22,440
So during setup, IT chooses which users, groups, contacts and details should sync.

95
00:05:22,440 --> 00:05:23,400
The rule can be simple.

96
00:05:23,400 --> 00:05:26,240
Pick certain organizational units often called OUs.

97
00:05:26,240 --> 00:05:30,200
An organizational unit is basically a folder inside Active Directory.

98
00:05:30,200 --> 00:05:35,640
Think of it like the local staff directory has folders called Finance, Sales, HR and IT.

99
00:05:35,640 --> 00:05:39,720
The company might sync those folders because the people inside them need Microsoft 365.

100
00:05:39,720 --> 00:05:43,200
Another folder, maybe test accounts or local services stays local.

101
00:05:43,200 --> 00:05:45,120
Only the chosen folders cross the bridge.

102
00:05:45,120 --> 00:05:46,920
That keeps the cloud directory cleaner,

103
00:05:46,920 --> 00:05:52,520
and it lowers the chance that an old local system account suddenly appears in Teams or Microsoft 365.

104
00:05:52,520 --> 00:05:56,000
Entra Connect also doesn't copy every detail from every selected record.

105
00:05:56,000 --> 00:05:57,880
The staff record holds lots of information.

106
00:05:57,880 --> 00:06:00,680
Some of it helps Microsoft 365 work properly.

107
00:06:00,680 --> 00:06:03,760
A name, work email address, department, group membership.

108
00:06:03,760 --> 00:06:07,800
Other details stay local because the company has no reason to send them to the cloud.

109
00:06:07,800 --> 00:06:10,520
It's like preparing a staff file for another office.

110
00:06:10,520 --> 00:06:15,000
You don't photocopy every page just because one department needs the employee's name and job title.

111
00:06:15,000 --> 00:06:19,120
You send the pages they need following the rules the company chose during setup.

112
00:06:19,120 --> 00:06:21,120
This all runs quietly behind the scenes.

113
00:06:21,120 --> 00:06:24,600
In a typical setup, Entra Connect checks for changes about every 30 minutes.

114
00:06:24,600 --> 00:06:27,840
It sends the differences not the entire directory over and over.

115
00:06:27,840 --> 00:06:32,080
So if only Alex's department changes, Entra Connect focuses on that one change.

116
00:06:32,080 --> 00:06:36,680
It doesn't need to rebuild every employee record in Entra ID just because Alex moved from sales to marketing.

117
00:06:36,680 --> 00:06:38,440
Let's follow Alex on their first day.

118
00:06:38,440 --> 00:06:41,680
HR records Alex's name, department and other starter details.

119
00:06:41,680 --> 00:06:48,880
Then IT creates Alex's account in the local active directory and places it in an organizational unit that syncs to Microsoft Entra ID.

120
00:06:48,880 --> 00:06:52,880
At the next sync, Entra Connect sees a new staff record that matches its rules.

121
00:06:52,880 --> 00:06:59,120
It creates or connects Alex's cloud identity in Entra ID ready for Microsoft 365.

122
00:06:59,120 --> 00:07:05,240
If IT later corrects Alex's display name changes the department, adds Alex to a group, updates, and email detail,

123
00:07:05,240 --> 00:07:09,080
or disables the local account, Entra Connect sends those changes across to.

124
00:07:09,080 --> 00:07:10,640
That's the day-to-day job of sync.

125
00:07:10,640 --> 00:07:15,600
Names move across, group membership can move across, email details move across, accounts data moves across.

126
00:07:15,600 --> 00:07:17,160
And that last one deserves attention.

127
00:07:17,160 --> 00:07:23,440
If someone leaves the company and IT disables their local account, the matching cloud account needs to receive that change.

128
00:07:23,440 --> 00:07:29,720
A working sync keeps access tied to the person's real job status instead of relying on someone to remember two separate updates.

129
00:07:29,720 --> 00:07:31,000
But sync has a clear limit.

130
00:07:31,000 --> 00:07:34,080
Entra Connect doesn't assign a Microsoft 365 license,

131
00:07:34,080 --> 00:07:36,440
just because it creates Alex's cloud account.

132
00:07:36,440 --> 00:07:38,480
It also doesn't create a mailbox by itself.

133
00:07:38,480 --> 00:07:39,800
Those are separate tasks.

134
00:07:39,800 --> 00:07:43,120
A license gives Alex access to the services the company pays for.

135
00:07:43,120 --> 00:07:46,400
Exchange online then uses that license to create the mailbox.

136
00:07:46,400 --> 00:07:53,920
Entra Connect brings across the identity, while Microsoft 365 services use that identity once the right access and license are in place.

137
00:07:53,920 --> 00:07:55,840
This separation confuses people at first.

138
00:07:55,840 --> 00:08:00,360
They see Alex appear in Entra ID, then expect a mailbox to appear at the same moment.

139
00:08:00,360 --> 00:08:03,360
But the cloud account is the staff record at reception.

140
00:08:03,360 --> 00:08:06,480
The license decides which work rooms Alex can actually use.

141
00:08:06,480 --> 00:08:10,440
The local Active Directory stays as the main filing cabinet for synced employees.

142
00:08:10,440 --> 00:08:14,480
So if Alex is job title or department changes, IT normally updates it there.

143
00:08:14,480 --> 00:08:20,240
Entra Connect carries the change to Entra ID that prevents two people editing two records and slowly creating a mismatch.

144
00:08:20,240 --> 00:08:22,680
There's another small job happening behind the scenes.

145
00:08:22,680 --> 00:08:28,120
When Alex already exists in the cloud, Entra Connect needs to know which cloud record belongs to which local record.

146
00:08:28,120 --> 00:08:34,280
It uses matching details built into the identity records, so it updates the right Alex rather than creating a second account with a similar name.

147
00:08:34,280 --> 00:08:37,320
That's why this isn't just copying names from one place to another.

148
00:08:37,320 --> 00:08:41,080
It's maintaining a link between two records that represent the same person.

149
00:08:41,080 --> 00:08:44,080
But copied identity details only solve half the problem.

150
00:08:44,080 --> 00:08:48,320
Alex also needs a way to prove their really Alex when signing in.

151
00:08:48,320 --> 00:08:55,160
Building block two, Authentication Sync can place Alex's work identity in Entra ID, but a record alone can't sign in.

152
00:08:55,160 --> 00:08:58,040
Authentication is the check that proves Alex is really Alex.

153
00:08:58,040 --> 00:09:03,120
When they type a work email address and password into Teams Outlook or any other Microsoft 365 service,

154
00:09:03,120 --> 00:09:07,320
think about a company where Alex signs into a Windows laptop in the morning then opens Outlook and Teams.

155
00:09:07,320 --> 00:09:12,320
Nobody wants Alex to remember one password for the local network and a different password for Microsoft 365.

156
00:09:12,320 --> 00:09:13,600
That's the practical goal.

157
00:09:13,600 --> 00:09:14,920
One work identity.

158
00:09:14,920 --> 00:09:16,280
One familiar password.

159
00:09:16,280 --> 00:09:18,720
Access to the places Alex needs for work.

160
00:09:18,720 --> 00:09:23,440
Entra Connect helps the local directory and Entra ID use a chosen sign-in method.

161
00:09:23,440 --> 00:09:27,920
There are a few options and their names can sound more complicated than the idea behind them.

162
00:09:27,920 --> 00:09:31,160
The option most companies use is password hash synchronization.

163
00:09:31,160 --> 00:09:34,520
The name sounds alarming at first because it includes the word password.

164
00:09:34,520 --> 00:09:37,840
But Entra Connect doesn't copy Alex's readable password into the cloud.

165
00:09:37,840 --> 00:09:41,440
Nobody opens Entra ID and sees Alex's password written down.

166
00:09:41,440 --> 00:09:45,080
Instead Active Directory stores password information in a protected form.

167
00:09:45,080 --> 00:09:50,720
Entra Connect takes that protected information, applies another protected step, and sends the result to Entra ID.

168
00:09:50,720 --> 00:09:57,880
Entra ID can then check whether the password Alex enters is correct without needing the local Active Directory server to answer every cloud sign-in request.

169
00:09:57,880 --> 00:10:02,160
Picture it like a lock that recognizes the right-shaped key but never keeps a copy of the key itself.

170
00:10:02,160 --> 00:10:07,520
With password hash synchronization, Entra ID checks Alex's Microsoft 365 sign-in.

171
00:10:07,520 --> 00:10:11,560
This is often called cloud authentication because the check happens in Microsoft's cloud.

172
00:10:11,560 --> 00:10:14,120
For most organizations, this is the usual choice.

173
00:10:14,120 --> 00:10:22,040
It keeps the sign-in experience simple and it means Alex can often still reach Microsoft 365 if the local Office network or local Active Directory has a problem.

174
00:10:22,040 --> 00:10:25,720
The cloud can verify the sign-in without waiting for the company's local server.

175
00:10:25,720 --> 00:10:27,800
That doesn't mean the local directory stops mattering.

176
00:10:27,800 --> 00:10:35,240
It remains the place where Alex's password normally changes and Entra Connect keeps the protected password information current in Entra ID.

177
00:10:35,240 --> 00:10:39,200
But when Alex signs into Microsoft 365, Entra ID handles the check.

178
00:10:39,200 --> 00:10:42,800
Some companies choose a different method called pass-through authentication.

179
00:10:42,800 --> 00:10:51,560
With this method, Entra ID receives Alex's sign-in request, then asks a secure agent inside the company network to check that password against local Active Directory.

180
00:10:51,560 --> 00:10:55,760
Entra ID is still involved but the local directory gives the final yes or no for the password.

181
00:10:55,760 --> 00:11:01,520
You can think of it like calling a local Office to confirm a visitor's details before allowing them into an online meeting.

182
00:11:01,520 --> 00:11:05,720
It fits companies that need the local directory to remain part of every password check.

183
00:11:05,720 --> 00:11:09,440
But it also means the local systems and the sign-in agents need to stay available.

184
00:11:09,440 --> 00:11:12,520
If that connection breaks, cloud sign-ins can become a problem.

185
00:11:12,520 --> 00:11:13,960
Then there is Federation.

186
00:11:13,960 --> 00:11:17,280
Federation means another identity system handles the sign-in check.

187
00:11:17,280 --> 00:11:21,000
A company may already use a separate sign-in service with special rules,

188
00:11:21,000 --> 00:11:25,200
older business apps, smart cards or other company-specific needs.

189
00:11:25,200 --> 00:11:29,040
In that setup, Entra ID hands Alex's sign-in over to that system,

190
00:11:29,040 --> 00:11:32,080
which checks the identity and sends Entra ID an answer.

191
00:11:32,080 --> 00:11:33,240
Federation can make sense.

192
00:11:33,240 --> 00:11:37,160
It just brings more moving parts, more planning and more things that need support.

193
00:11:37,160 --> 00:11:41,680
That's why it usually appears in companies that already have a strong reason for it,

194
00:11:41,680 --> 00:11:46,480
rather than as the default choice for a new Microsoft 365 setup.

195
00:11:46,480 --> 00:11:48,160
So which option should you remember?

196
00:11:48,160 --> 00:11:49,240
Password hash.

197
00:11:49,240 --> 00:11:54,720
Synchronization fits most organizations because Entra ID can check Microsoft 365 sign-ins directly

198
00:11:54,720 --> 00:11:56,880
while users keep the same password they know.

199
00:11:56,880 --> 00:12:01,920
Pass through authentication fits cases where the local directory must check the password at sign-in.

200
00:12:01,920 --> 00:12:06,000
Federation fits companies with an existing sign-in system and rules they need to keep.

201
00:12:06,000 --> 00:12:08,240
The choice isn't about picking the fanciest name.

202
00:12:08,240 --> 00:12:12,560
It's about deciding where the password check happens and what the company needs to keep running.

203
00:12:12,560 --> 00:12:14,360
There's one common mix-up worth clearing up.

204
00:12:14,360 --> 00:12:18,120
Entra Connect doesn't replace multi-factor authentication, often called MFA.

205
00:12:18,120 --> 00:12:20,240
It also doesn't replace conditional access.

206
00:12:20,240 --> 00:12:22,480
Authentication answers the first question.

207
00:12:22,480 --> 00:12:24,000
Is this really Alex?

208
00:12:24,000 --> 00:12:28,080
MFA asks for another proof, like approval in an app on Alex's phone.

209
00:12:28,080 --> 00:12:30,880
Conditional access checks the situation around the sign-in.

210
00:12:30,880 --> 00:12:32,600
Is Alex using a trusted device?

211
00:12:32,600 --> 00:12:34,880
Is the sign-in coming from an expected place?

212
00:12:34,880 --> 00:12:37,440
Does the company require extra proof before access?

213
00:12:37,440 --> 00:12:39,600
Entra ID handles those cloud security checks.

214
00:12:39,600 --> 00:12:42,000
Imagine Alex reaches reception with a work pass.

215
00:12:42,000 --> 00:12:44,680
Authentication checks that the pass belongs to Alex.

216
00:12:44,680 --> 00:12:47,000
MFA may ask Alex to confirm with the phone.

217
00:12:47,000 --> 00:12:50,880
Conditional access checks whether Alex can enter under the current conditions.

218
00:12:50,880 --> 00:12:55,680
Each part has its own job. Entra Connect helps bring the identity and chosen sign-in method together.

219
00:12:55,680 --> 00:12:58,160
Entra ID applies the cloud access rules after that.

220
00:12:58,160 --> 00:13:00,880
There's also a useful option called password writeback.

221
00:13:00,880 --> 00:13:05,680
Suppose Alex forgets a password while working from home and uses a Microsoft 365 Self-Service

222
00:13:05,680 --> 00:13:07,320
password reset page.

223
00:13:07,320 --> 00:13:11,120
With password writeback setup, that new password can travel back to the local Active Directory

224
00:13:11,120 --> 00:13:12,120
2.

225
00:13:12,120 --> 00:13:13,120
Alex changes the password once.

226
00:13:13,120 --> 00:13:16,280
Both the cloud and local work account stay in step.

227
00:13:16,280 --> 00:13:19,600
That feature needs deliberate setup, so it isn't something to switch on without understanding

228
00:13:19,600 --> 00:13:23,680
the company's rules, but it solves a very real problem for hybrid companies, especially

229
00:13:23,680 --> 00:13:25,320
when staff work away from the office.

230
00:13:25,320 --> 00:13:27,840
The sign-in path is only useful while it works.

231
00:13:27,840 --> 00:13:32,200
A bridge-carrying staff access also needs someone watching for trouble.

232
00:13:32,200 --> 00:13:33,200
Building block 3.

233
00:13:33,200 --> 00:13:34,200
Health

234
00:13:34,200 --> 00:13:36,920
A connection can look fine until it stops working.

235
00:13:36,920 --> 00:13:38,880
Entra Connect Health is the monitoring layer.

236
00:13:38,880 --> 00:13:43,320
It watches the connection and gives IT early warning when something needs attention.

237
00:13:43,320 --> 00:13:45,920
Think of it like a status board in an operations room.

238
00:13:45,920 --> 00:13:49,200
Nobody has to stare at it all day, but somebody needs to know when a light changes from

239
00:13:49,200 --> 00:13:51,040
green to red if the sync stops.

240
00:13:51,040 --> 00:13:55,640
If a server reports a problem or if certain accounts fail to sync, health can raise an alert.

241
00:13:55,640 --> 00:13:59,880
Sync problems often start quietly and that "O" term as "why this matters".

242
00:13:59,880 --> 00:14:04,200
A new employee might not appear in Microsoft 365 or a department change might not reach

243
00:14:04,200 --> 00:14:07,320
the cloud or a password change might not work as expected.

244
00:14:07,320 --> 00:14:11,240
Those are frustrating problems, but the serious problem shows up when someone leaves.

245
00:14:11,240 --> 00:14:13,880
Imagine Alex leaves the company on Friday afternoon.

246
00:14:13,880 --> 00:14:19,360
The IT disables AlexOTMS account in local Active Directory, which should stop the matching cloud

247
00:14:19,360 --> 00:14:21,040
account from working too.

248
00:14:21,040 --> 00:14:25,240
The sync service stopped earlier that day, maybe after a server update or a connection problem,

249
00:14:25,240 --> 00:14:30,000
the local account is disabled, but the cloud account has now time to receive that change.

250
00:14:30,000 --> 00:14:34,780
Alex could still have access to Microsoft 365 until someone notices the failed sync and

251
00:14:34,780 --> 00:14:35,940
fixes it.

252
00:14:35,940 --> 00:14:38,480
That gap is exactly why monitoring matters.

253
00:14:38,480 --> 00:14:40,480
Itardams not about keeping a dashboard tidy out.

254
00:14:40,480 --> 00:14:44,760
Itardams about making sure access changes actually reach the place where people work.

255
00:14:44,760 --> 00:14:49,120
EntraConnect Health can help IT spot warnings before users start opening support tickets.

256
00:14:49,120 --> 00:14:53,920
It can point to a stopped sync service, fail attempts, server issues or sign-in problems.

257
00:14:53,920 --> 00:14:58,120
Instead of waiting for someone to ask why they can't access their account, IT has a reason

258
00:14:58,120 --> 00:14:59,800
to check the connection first.

259
00:14:59,800 --> 00:15:03,720
You don't know what need to become an EntraConnect expert to understand the basic checks.

260
00:15:03,720 --> 00:15:07,360
Ask when the last successful sync RAM and look for records that fail to sync.

261
00:15:07,360 --> 00:15:11,240
Check whether the server is healthy and whether the sync service is still running.

262
00:15:11,240 --> 00:15:15,720
Read unexpected error messages instead of assuming they who, Tim, will fix themselves.

263
00:15:15,720 --> 00:15:17,560
That would mean it's the beginner view of health.

264
00:15:17,560 --> 00:15:22,360
It watches the moving parts and warns it when the link between the local directory and

265
00:15:22,360 --> 00:15:24,200
Entra ID needs attention.

266
00:15:24,200 --> 00:15:27,800
So sync carries record changes, authentication checks, sign-ins and health watches whether

267
00:15:27,800 --> 00:15:29,320
those jobs keep working.

268
00:15:29,320 --> 00:15:34,120
But hybrid identity still has boundaries and EntraConnect does no TMT solve every identity

269
00:15:34,120 --> 00:15:35,840
problem in a company.

270
00:15:35,840 --> 00:15:37,680
EntraConnect does not do.

271
00:15:37,680 --> 00:15:39,840
Hereout means something important.

272
00:15:39,840 --> 00:15:42,360
EntraConnect is not a cloud backup of Active Directory.

273
00:15:42,360 --> 00:15:47,480
It sends selected identity details to Entra ID so Microsoft 365 can use them, but that does

274
00:15:47,480 --> 00:15:54,520
no TMT mean Entra ID becomes a full copy of every local record, setting or server configuration.

275
00:15:54,520 --> 00:15:58,360
If a company needs to recover local Active Directory after a serious problem, it needs

276
00:15:58,360 --> 00:16:02,240
a proper backup and recovery plan for Active Directory itself.

277
00:16:02,240 --> 00:16:05,280
EntraConnect also does no TMT replace Microsoft Entra ID.

278
00:16:05,280 --> 00:16:12,080
EntraConnect is the connection method for organizations that still keep Active Directory

279
00:16:12,080 --> 00:16:13,560
on their own network.

280
00:16:13,560 --> 00:16:19,600
If their own TMS, no local Active Directory, their own TMS is usually no need for Entra Connect.

281
00:16:19,600 --> 00:16:24,280
A cloud-only company can manage staff accounts directly in Entra ID, installing Entra Connect

282
00:16:24,280 --> 00:16:27,000
would add complexity without solving a real problem.

283
00:16:27,000 --> 00:16:30,160
It also can also attempt to clean up a messy directory by itself.

284
00:16:30,160 --> 00:16:33,880
If the local directory has duplicate names, old email addresses or records that don't

285
00:16:33,880 --> 00:16:38,400
now, on Tamachi, follow naming rules, Entra Connect will carry that information according

286
00:16:38,400 --> 00:16:43,920
to its own rules, but it can A-E-T-T decide which messy record is correct.

287
00:16:43,920 --> 00:16:45,400
Bad information can still travel.

288
00:16:45,400 --> 00:16:49,680
That O-TMS-Y companies should sort out obvious identity problems before syncing large groups,

289
00:16:49,680 --> 00:16:53,280
otherwise the cloud receives the same confusion that already exists locally.

290
00:16:53,280 --> 00:16:56,480
Entra Connect is also not the tool that creates every security rule.

291
00:16:56,480 --> 00:16:58,160
Entra ID handles sign-in controls.

292
00:16:58,160 --> 00:17:00,000
MFA asks for extra proof.

293
00:17:00,000 --> 00:17:02,600
Conditional access applies rules based on the situation.

294
00:17:02,600 --> 00:17:04,360
Entra-Tune manages devices.

295
00:17:04,360 --> 00:17:06,800
Defender watches for threats across the connected platform.

296
00:17:06,800 --> 00:17:08,400
Each tool has a separate job.

297
00:17:08,400 --> 00:17:12,080
Entra Connect connects a local identity to the cloud, but it does not in T replace the

298
00:17:12,080 --> 00:17:16,600
people, policies or security tools that protect that identity once it reaches Microsoft

299
00:17:16,600 --> 00:17:18,000
365.

300
00:17:18,000 --> 00:17:20,080
Another point catches many people out.

301
00:17:20,080 --> 00:17:23,680
Standard Sync goes one way from local Active Directory to Entra ID.

302
00:17:23,680 --> 00:17:28,280
It outermy is not a free for all two-way link where every cloud change writes back locally.

303
00:17:28,280 --> 00:17:31,240
That would create too many conflicting records and accidental changes.

304
00:17:31,240 --> 00:17:35,120
Some selected writeback features exist when a company sets them up deliberately, like password

305
00:17:35,120 --> 00:17:36,120
writeback.

306
00:17:36,120 --> 00:17:40,200
A cloud password reset can update the local password too, but only when configured, writeback

307
00:17:40,200 --> 00:17:42,280
is the exception not the default.

308
00:17:42,280 --> 00:17:44,280
You may also hear two similar names.

309
00:17:44,280 --> 00:17:46,240
Entra Connect Sync and Cloud Sync.

310
00:17:46,240 --> 00:17:49,840
Both connect local Active Directory with Entra ID, but in different ways.

311
00:17:49,840 --> 00:17:54,000
Entra Connect Sync runs inside the company network and many hybrid organizations already

312
00:17:54,000 --> 00:17:55,000
rely on it.

313
00:17:55,000 --> 00:17:58,880
Cloud Sync uses lighter local agents and cloud-based management for the sync setup.

314
00:17:58,880 --> 00:18:02,040
The loud and T-pig based on which name sounds newer.

315
00:18:02,040 --> 00:18:05,480
Entra Connect Sync often fits established hybrid environments.

316
00:18:05,480 --> 00:18:09,120
Cloud Sync can suit other companies depending on how their directory is arranged and what

317
00:18:09,120 --> 00:18:10,120
they need to sync.

318
00:18:10,120 --> 00:18:11,600
The question is simple.

319
00:18:11,600 --> 00:18:15,160
Which connection method fits the company's real identity setup?

320
00:18:15,160 --> 00:18:20,080
With that boundary clear, we can return to Alex and see how sync, authentication and health

321
00:18:20,080 --> 00:18:23,760
fit into one employee, OTM is working day.

322
00:18:23,760 --> 00:18:27,040
One employee, one connected identity.

323
00:18:27,040 --> 00:18:30,360
So Alex from the moment HR adds a new starter record, are you?

324
00:18:30,360 --> 00:18:32,600
I'd create his account in local Active Directory.

325
00:18:32,600 --> 00:18:37,120
And Entra Connect carries that identity to Entra ID so he can use Teams, OneDrive, Exchange

326
00:18:37,120 --> 00:18:42,640
Online and the rest of Microsoft 365 without anyone building a second account by hand.

327
00:18:42,640 --> 00:18:47,160
When Alex signs in, the chosen authentication method checks his familiar work password.

328
00:18:47,160 --> 00:18:51,720
Later if Alex changes department, resets a password or leaves the company, health helps

329
00:18:51,720 --> 00:18:55,520
IT spot a problem if those changes don't travel as expected.

330
00:18:55,520 --> 00:18:59,880
After the whole setup as one office building, O, Active Directory is the local records room,

331
00:18:59,880 --> 00:19:03,840
Entra ID is the cloud reception desk, Entra Connect is the guarded bridge between them and

332
00:19:03,840 --> 00:19:06,160
health is the monitoring desk watching the bridge.

333
00:19:06,160 --> 00:19:07,960
That's the magic of it, everything stays in sync.

334
00:19:07,960 --> 00:19:12,400
So the answer to our opening question is that Entra Connect keeps local and cloud identities

335
00:19:12,400 --> 00:19:16,280
connected, so staff access never depends on duplicate manual account work.

336
00:19:16,280 --> 00:19:19,760
Now how can you check whether this applies in your own company?

337
00:19:19,760 --> 00:19:21,440
Put the knowledge nugget to work.

338
00:19:21,440 --> 00:19:23,520
Here's the simplest way to think about it.

339
00:19:23,520 --> 00:19:25,480
Entra Connect is hybrid identity plumbing.

340
00:19:25,480 --> 00:19:27,280
You can open it every day.

341
00:19:27,280 --> 00:19:32,120
Start by asking one simple question, "Oh does your company still use local Active Directory?"

342
00:19:32,120 --> 00:19:36,320
If it does, find out where staff accounts begin, where password checks happen and who receives

343
00:19:36,320 --> 00:19:38,000
alerts when sync fails.

344
00:19:38,000 --> 00:19:43,280
Those three answers reveal the building blocks, sync, authentication and health monitoring,

345
00:19:43,280 --> 00:19:45,440
and make sure you know who's watching that bridge.

346
00:19:45,440 --> 00:19:48,760
Don't change sync settings casually because one small change can affect who appears in

347
00:19:48,760 --> 00:19:52,200
Microsoft 365 and who can access work services.

348
00:19:52,200 --> 00:19:57,320
First, learn how Entra ID works as the cloud reception desk, then move onto MFA and conditional

349
00:19:57,320 --> 00:19:58,320
access.

350
00:19:58,320 --> 00:20:01,280
Remember, the real power isn't any single product A/O.

351
00:20:01,280 --> 00:20:02,600
It's how they all work together.

352
00:20:02,600 --> 00:20:05,880
Subscribe on your favorite podcast platform and share this with a colleague moving from

353
00:20:05,880 --> 00:20:07,880
local servers to Microsoft 365.