Hybrid Identity Engineering

Engineering Deep Dive R1 Workplace R2 Delivery R2 Network R2 Platform R2 Operations

Scope

Hybrid identity notes for the on-premises Active Directory to Microsoft Entra ID integration used in Release 1. The evidence route uses Release 1 documentation, screenshots, and Microsoft Graph PowerShell validation output.

Identity model

Release 1 uses on-premises Active Directory as the authoritative identity source and Microsoft Entra ID as the cloud identity and access layer.

The implementation uses scoped synchronisation rather than a broad tenant-wide sync model. Entra Connect Sync started with pilot users and selected objects before wider platform services depended on cloud identity state.

Design choice	Why it matters	Evidence route
Active Directory remains the source of authority	Keeps the identity model grounded in a realistic Microsoft hybrid enterprise environment, not a cloud-only tenant demo.	Hybrid identity documentation
Entra Connect Sync uses controlled pilot filtering	Reduces synchronisation risk by introducing cloud identity through scoped inclusion rather than bulk replication.	Entra Connect filtering evidence
Password Hash Synchronization supports cloud authentication	Provides a supportable hybrid authentication path for Microsoft 365 and downstream Release 1 validation.	Hybrid identity documentation
Pilot users are validated in Microsoft 365	Confirms that synchronized identities are visible and usable for Microsoft 365, Exchange Hybrid, and endpoint management work.	Pilot users in Microsoft 365

Access-control baseline

Hybrid identity becomes useful when policy enforcement and sign-in evidence are visible. Release 1 ties synchronized identity state to Conditional Access, MFA, SSPR, pilot group design, and operational sign-in visibility.

Control area	Implementation signal	Evidence path
Conditional Access	Access policy is visible through sign-in evaluation rather than presented only as design intent.	Conditional Access result evidence
MFA and SSPR	Identity hardening and supportability are part of the Release 1 access model.	Hybrid identity documentation
Pilot users and groups	Pilot scope, administrator identities, and group design support controlled validation rather than unrestricted tenant-wide rollout.	Identity and Access Evidence Hub

Graph PowerShell lifecycle validation

Release 1 extends beyond synchronization and portal configuration. Later validation added Microsoft Graph PowerShell workflows for operator-led identity lifecycle actions.

The identity layer can be administered through repeatable Microsoft Graph PowerShell workflows, not only through portal changes.

The validated lifecycle scenarios are:

• Disable a pilot user account.
• Revoke active user sessions.
• Restore the user account to active state.
• Update user profile attributes for a mover scenario.
• Trigger dynamic group recalculation from a department change.
• Validate downstream application access through the user's My Apps experience.

Lifecycle capability	Validation signal	Evidence route
Graph admin consent	Required delegated permissions were captured before lifecycle operations were demonstrated.	Graph admin consent for user enable and disable
Disable user	Graph PowerShell output confirms the pilot account was disabled through an operator-led workflow.	User access disable apply result
Revoke sessions	Graph PowerShell output confirms active sessions were revoked to force access removal.	User session revoke apply result
Profile update	An interactive Graph PowerShell workflow updates the user's department and job title as part of the mover scenario.	Profile update apply result
Dynamic group recalculation	The user moves into the Operations-linked Slack group after the department change.	Operations Slack group membership
Downstream access outcome	Slack becomes available in My Apps after the department-driven group membership change.	Slack available in My Apps

Engineering significance

The identity layer is built around three decisions:

1. Hybrid identity was introduced through controlled scope rather than broad synchronization.
2. Access policy was connected to sign-in evidence and operational visibility.
3. Identity administration was extended with Graph PowerShell lifecycle validation, including disable, session revoke, restore, mover, dynamic group, and application access outcomes.

Together, the evidence shows the identity model in operation: directory authority, synchronisation control, access enforcement, sign-in visibility, and repeatable lifecycle actions.

Evidence map

Claim	Evidence route	What to check
Active Directory remains the source of authority while Microsoft Entra ID provides cloud identity and access	Hybrid identity documentation	Identity design approach and implementation notes
Entra Connect Sync was introduced through pilot filtering	Entra Connect filtering evidence	Filtering and controlled synchronization scope
Pilot users appeared in Microsoft 365 after synchronization	Pilot users in Microsoft 365	Synchronized pilot users visible in Microsoft 365
Conditional Access was visible in sign-in results	Conditional Access result evidence	Conditional Access evaluation in sign-in logs
Microsoft Graph PowerShell lifecycle actions were validated	Release 1 hybrid identity documentation	Access-state and mover scenario evidence
User disable and session revoke were executed through Graph PowerShell	Disable evidence and session revoke evidence	Script output showing access-state control
Department change triggered group and application access outcomes	Operations Slack group evidence and My Apps Slack evidence	Dynamic group membership and downstream application availability

Review takeaway

Hybrid Identity Engineering connects controlled synchronisation, access-policy enforcement, Microsoft 365 readiness, and Microsoft Graph PowerShell lifecycle administration.

This identity layer supports the rest of the portfolio: Microsoft 365 operations, endpoint management, secure AVD access, administrative workflows, and later platform operations.