Hybrid Identity and Global Secure Access with Microsoft Entra ID

What this guide covers

Hybrid identity breaks in two places people constantly confuse. There is a synchronization plane that moves identity objects from Active Directory into Microsoft Entra ID, and there is an authentication plane that decides whether a credential is valid at sign-in. Almost every "why can't users log in from home" incident traces back to someone touching one plane while thinking they were touching the other. The documentation describes both, but it describes them on different pages, under old and new product names, with the licensing floor buried three clicks away from the feature it gates.

Global Secure Access makes it worse. It gets dismissed as a network product and then turns up as a named objective group inside the SC-300 exam's authentication and access management domain, which carries 25 to 30 percent of the weight, because it is an identity product that happens to control network traffic.

This book is the connected account those scattered pages never give you. It walks Connect Sync and Cloud Sync, PHS, PTA, federation, Cloud Kerberos Trust, and the full Global Secure Access stack as one system, and it names the failure modes before you hit them in a live tenant. Every product specific, every license boundary, and every retirement deadline is grounded against current Microsoft Learn and validated in a live Microsoft 365 E5 lab. You do not need a production forest to follow along; a trial tenant and one test box are enough.

Chapter map

1. The Hybrid Identity Stack, What It Is, Where It Lives, and Why It Matters
2. Licensing, Prerequisites, and the Decision to Deploy
3. Connect Sync vs. Cloud Sync, Architecture and the Right Tool for the Job
4. The Sync Engine Deep Dive, Connectors, Metaverse, Attribute Flow, and Filtering
5. Source Anchor, Object Matching, and Writeback
6. Authentication Options, PHS, PTA, and Federation
7. Seamless SSO and Staged Rollout
8. Microsoft Entra Connect Health, Monitoring the Hybrid Tier
9. Microsoft Entra Cloud Kerberos Trust, Modern Hybrid Authentication
10. Troubleshooting Sync, IdFix, Errors, and Duplicate Attributes
11. Global Secure Access Architecture, The GSA Client, Traffic Profiles, and Private Access
12. Internet Access, Microsoft Traffic Profile, and Tenant Restrictions
13. Production Readiness, Conditional Access Integration, Compliant Network, and Go-Live Checklist

Appendices: PowerShell and Graph Quick Reference; Build a Lab Tenant; Production Readiness Checklist.

Who it is for

This book is for administrators, identity engineers, and IT pros who run or are ramping onto hybrid identity and Global Secure Access and want the moving parts connected rather than listed, and for anyone preparing for the SC-300, Identity and Access Administrator exam who wants depth past the objectives list on the synchronization, authentication, and Global Secure Access domains.

See where you are

7 questions from this guide's territory (3 easy, 4 medium), with the explanation after each. Nothing is stored and nothing is sent anywhere.

The rest of Microsoft Entra Field Guides

One product per book, a lab appendix in every one, and a companion page like this one for each.

• 
  Field guide

  Authentication and Conditional Access with Microsoft Entra ID

  Most sign-in lockouts and silent MFA gaps do not trace to one wrong setting.

  Kindle$12.99Get it on AmazonCompanion page
• 
  Field guide

  Microsoft Entra ID Fundamentals Field Guide

  Most Microsoft Entra ID problems are not bugs. They are gaps the portal never warns you about.

  Kindle$12.99Get it on AmazonCompanion page
• 
  Field guide

  Identity Governance with Microsoft Entra ID

  Knowing what each governance pillar does is the easy part. Knowing how the four break in production is the part the portal blades never tell you.

  Kindle$12.99Get it on AmazonCompanion page
• 
  Field guide

  Workload Identities and App Registrations with Microsoft Entra ID

  The breach rarely starts with a misconfigured Conditional Access policy. It starts with a three-year-old client secret sitting in a public repository, attached to an app nobody remembers registering.

  Kindle$12.99Get it on AmazonCompanion page

The hard set (2 questions)

The hardest SC-300 questions this guide publishes, none of them repeated from the placement quiz above: the answer first, why every other option is wrong, and the Microsoft Learn page behind it. The practice book for this exam holds the full bank.

An organization deploys Microsoft Entra Private Access as part of Global Secure Access to replace its legacy VPN for remote users. Which statement accurately describes what Microsoft Entra Private Access provides that a traditional VPN does not?

Correct answer: C. Private Access provides per-app Zero Trust Network Access using Conditional Access policies for each private resource

Microsoft Entra Private Access provides Zero Trust Network Access (ZTNA) at a per-application level, allowing granular Conditional Access policies to be applied to each private resource or app individually. Traditional VPNs grant access to an entire network segment once a user authenticates, which can allow lateral movement. Private Access supports per-app access for TCP and UDP applications, Quick Access for IP and FQDN ranges, and integrates deeply with Conditional Access for more granular security than a VPN provides.

Why the other options are wrong:

• A. Private Access does not mandate FIDO2 keys. It enforces Conditional Access policies, which can require various authentication strengths, but it does not itself require FIDO2 specifically.
• B. Universal Tenant Restrictions is a feature of Microsoft Entra Internet Access for Microsoft services, which prevents users from authenticating to unauthorized external tenants. It is not a Private Access feature.
• D. Tunneling internet traffic to block malicious sites is the function of Microsoft Entra Internet Access (the Secure Web Gateway component), not Private Access. Private Access focuses on private, internal corporate resources.

Memory hook: VPN = opens the whole castle. Private Access = opens one specific room at a time, only if your Conditional Access badge allows it.

Microsoft Learn: Overview global secure access

A company currently uses AD FS with password hash synchronization (PHS) configured through Microsoft Entra Connect. The security team wants to move away from AD FS and adopt pass-through authentication (PTA) instead. Which statement correctly describes a key operational difference between PHS and PTA that the team must plan for?

Correct answer: B. PTA validates user credentials against on-premises Active Directory in real time, while PHS synchronizes a hash of the password to Microsoft Entra ID

With pass-through authentication, user credentials are validated directly against on-premises Active Directory Domain Services in real time via lightweight on-premises agents. No password hash or password is stored in Microsoft Entra ID. With password hash synchronization, a hash of the on-premises password is synchronized to Microsoft Entra ID, allowing authentication to occur in the cloud without any dependency on on-premises infrastructure at sign-in time. This is a critical planning difference: PTA requires on-premises PTA agents to be available for authentication to succeed.

Why the other options are wrong:

• A. PTA does require on-premises agents to handle real-time credential validation. It does not store credentials in Microsoft Entra ID. Only PHS can authenticate solely from the cloud after initial synchronization.
• C. PTA does not require AD FS. PTA uses its own lightweight agent installed on-premises, separate from AD FS infrastructure. Removing AD FS is actually a common reason for migrating from federation to PTA or PHS.
• D. This option swaps the two methods. PTA is the one that validates credentials through real-time on-premises agents; PHS is the one that stores a hash in the cloud.

Memory hook: PTA = Phone a friend on-premises every time. PHS = Hash stored in the cloud, no call needed.

Microsoft Learn: Whatis Azure ad connect