Microsoft Entra Connect is one of those Microsoft technologies almost everyone working with Microsoft 365 has heard about, but its actual job is often misunderstood. Why do organizations need it? What exactly gets synchronized between Active Directory and Microsoft Entra ID? Where are passwords checked? And what happens if synchronization stops working? In this episode of Microsoft Knowledge Nuggets on M365 FM, we break Microsoft Entra Connect down into its essential building blocks: synchronization, authentication, and health monitoring.

WHY HYBRID IDENTITY EXISTS
For many years, companies managed employee identities primarily through on-premises Active Directory. Employees signed into Windows, accessed internal file shares, used printers, and reached applications inside the corporate network using an account maintained locally.Then work moved into the cloud. Email moved to Exchange Online, meetings and collaboration moved into Microsoft Teams, personal files moved into OneDrive, and shared content increasingly moved into SharePoint. Microsoft 365 therefore needed its own cloud identity system: Microsoft Entra ID.Organizations that continue using Active Directory while also using Microsoft Entra ID operate a hybrid identity environment. The challenge is making sure those two identity systems represent the same employees instead of becoming two disconnected directories.

ACTIVE DIRECTORY AND MICROSOFT ENTRA ID
Think of Active Directory as the organization's local records room. It contains employee identities, departments, email addresses, group memberships, and information used to determine access to resources inside the corporate network.Microsoft Entra ID can be viewed as the cloud reception desk. When employees access Teams, Exchange Online, SharePoint, OneDrive, or other cloud services, Entra ID identifies them and participates in determining whether they should receive access.Both systems can therefore contain information about the same person, but they serve different environments. Microsoft Entra Connect provides the controlled bridge between them.

ONE EMPLOYEE, TWO IDENTITY SYSTEMS
Imagine a new employee named Alex joins the company. IT creates Alex's account in Active Directory so Alex can sign into a company Windows device and access local resources.But Alex also needs Teams, Exchange Online, OneDrive, SharePoint, and other Microsoft 365 services. Without synchronization, IT could end up manually creating and maintaining another identity in the cloud.That creates obvious problems. A department might change in one system but not the other. An employee could leave and have the local account disabled while the cloud account remains active. Passwords and other information could gradually become inconsistent.Microsoft Entra Connect links those identity records so they represent the same employee.

THE SOURCE OF AUTHORITY
For synchronized users, Active Directory normally remains the source of authority for synchronized identity information.If Alex moves from Sales to Marketing, administrators update the authoritative local record and Microsoft Entra Connect carries the appropriate change into Microsoft Entra ID. This prevents administrators from independently maintaining the same synchronized information in two places and potentially creating conflicting records.Microsoft Entra Connect therefore does not eliminate either directory. It maintains the relationship between them.

BUILDING BLOCK ONE: SYNCHRONIZATION
Microsoft Entra Connect Sync runs on a Windows Server within the organization's environment. That server acts as a controlled bridge between local Active Directory and Microsoft Entra ID.Importantly, organizations do not necessarily synchronize everything stored in Active Directory. Local directories often contain service accounts, test identities, disabled users, training accounts, and other objects that have no reason to exist in Microsoft 365.Administrators determine which users, groups, contacts, and identity information should cross the bridge.

USING ORGANIZATIONAL UNITS TO CONTROL SYNCHRONIZATION
One common method of controlling synchronization is selecting organizational units, usually called OUs.An Active Directory environment might contain separate OUs for Finance, Sales, HR, IT, test accounts, and service accounts. Organizations can synchronize the employee OUs that require Microsoft 365 while excluding local-only identities.This keeps the cloud directory cleaner and reduces the risk of unnecessary accounts appearing in Microsoft Entra ID.

HOW SYNCHRONIZATION WORKS DAY TO DAY
Microsoft Entra Connect periodically checks Active Directory for changes and synchronizes the appropriate differences rather than rebuilding the entire cloud directory every time something changes.When Alex joins the company, Entra Connect detects the new identity and synchronizes the appropriate information. If Alex later changes department, joins another group, receives updated email information, or has th...