Prepared Active Directory
Reviewed user accounts and user principal names before synchronisation and tested a routable UPN using the public domain.
Infrastructure / Cloud
Microsoft 365 Hybrid Identity Lab
Connecting an on-premises Windows Server Active Directory environment to Microsoft 365 using Entra Connect, while learning how hybrid identity, UPNs and directory synchronisation work in practice.
Windows Server 2025Active DirectoryMicrosoft 365Entra IDEntra ConnectPowerShell
Project Overview
What I set out to achieve
The goal of this project is to extend my on-premises Active Directory lab into Microsoft 365 and Entra ID, allowing me to explore hybrid identity administration in a realistic environment rather than working with cloud-only demo accounts.
Environment
Technology and lab context
The project uses a Windows Server 2025 domain controller in my segmented homelab, a Microsoft 365 E5 trial tenant, Entra ID and Microsoft Entra Connect. The lab is routed through OPNsense and uses the soundmagus.local Active Directory domain alongside a verified public sign-in domain.
What I Did
Implementation and investigation
Configured Entra Connect
Installed and configured Microsoft Entra Connect to connect the on-premises directory to the Microsoft 365 tenant.
Validated Synchronisation
Used PowerShell and Entra Connect tooling to inspect the ADSync service, scheduler behaviour, run profiles and directory objects.
Troubleshot Identity Issues
Worked through connector and management-agent problems methodically rather than simply rebuilding the environment.
Troubleshooting
Challenges encountered
UPN Compatibility
The internal Active Directory namespace is not publicly routable, so hybrid identity required careful handling of user principal names.
Sync Engine Errors
The Entra Connect sync engine reported management-agent related errors, which required checking the ADSync service, configuration and run history.
Learning
What this project taught me
Hybrid Identity
Developed a practical understanding of how on-premises identities are represented and synchronised into Entra ID.
PowerShell Diagnostics
Improved confidence using PowerShell to inspect Active Directory and Entra Connect state.
Structured Troubleshooting
Reinforced the value of validating each dependency before changing configuration.
Evidence & Troubleshooting
Examples from the live lab
Active Directory user review
I checked the current user principal names before synchronisation so I could identify which identities were still using the internal soundmagus.local suffix.
Get-ADUser -Filter * | Select-Object SamAccountName,UserPrincipalName,Enabled fmercury fmercury@markngray.co.uk True mjackson mjackson@soundmagus.local True dross dross@soundmagus.local True
This confirmed that the public UPN had been tested successfully on at least one account before wider hybrid identity changes.
Entra Connect service validation
When the sync tooling reported errors, I first confirmed that the sync service itself was running before making configuration changes.
Get-Service ADSync Status Name DisplayName ------ ---- ----------- Running ADSync Microsoft Azure AD Sync
This separated a service availability problem from a connector or management-agent configuration problem.
Problem → Investigation → Resolution path
Problem
Entra Connect commands reported that a specified management agent could not be found.
Investigation
Checked ADSync service state, scheduler output, run profiles, Active Directory users and UPN configuration.
Resolution path
Stopped the ADSync service safely and continued validating the connector configuration rather than repeatedly rerunning failing sync commands.
Next Steps
Where the project goes next
Complete the current Entra Connect troubleshooting, confirm stable directory synchronisation, then expand the lab into Intune device management, Conditional Access and broader Microsoft 365 administration.