Microsoft Entra ID Directory Synchronization Field Guide

What this guide covers

Run identity synchronization and the portal will tell you it worked. Every object shows green, licenses assign, and the run history is clean. Then a third of your users cannot sign in. Hybrid identity fails quietly. A mismatched UPN suffix is rewritten to .onmicrosoft.com, a duplicate proxyAddress drops the second user with no warning, and a renamed OU queues thousands of accounts for deletion on the next cycle. Microsoft Learn documents each tool in isolation and never connects the symptom you are staring at to the decision you made three steps earlier.

This book is the end-to-end account that Learn scatters across forty pages, written to name each failure mode before you hit it in production. It walks the full pipeline from Active Directory cleanup and IdFix, through the source anchor and UPN alignment that decide whether an object matches or duplicates, into the Connect Sync versus Cloud Sync choice that shapes everything downstream, and out to staging mode, disaster recovery, and the troubleshooting you do when the pipeline breaks at the worst possible hour.

Every limit, license gate, and behavior is grounded against current Microsoft Learn and validated in a live Microsoft 365 E5 lab against a real test forest. You do not need a production tenant to follow along; a lab forest, a trial tenant, and one sync host are enough to reproduce nearly everything here.

Chapter map

1. The Case for Hybrid Identity: Architecture, Stack, and Exam Relevance
2. Licensing, Prerequisites, and Server Sizing
3. Preparing Active Directory: Attribute Cleanup and IdFix
4. UPN Alignment, Non-Routable Domains, and the Source Anchor
5. Choosing the Right Sync Tool: Connect Sync vs. Cloud Sync
6. Installing and Configuring Microsoft Entra Connect Sync
7. The Sync Engine: Connectors, Metaverse, Run Profiles, and Filtering
8. Staging Mode, High Availability, and Disaster Recovery for Connect Sync
9. Microsoft Entra Cloud Sync: Agents, Configuration, and On-Demand Provisioning
10. Authentication Methods at Sync Time: PHS, PTA, and Federation Overview
11. Monitoring with Microsoft Entra Connect Health
12. Troubleshooting Synchronization Errors: Duplicates, Missing Objects, and Agent Issues
13. Pre-Production Checklist: From Lab to Live Synchronization

Appendices: PowerShell and Graph Quick Reference; Build a Lab Tenant; Production Readiness Checklist.

Who it is for

This book is for administrators and engineers who run Microsoft 365 hybrid identity and want the moving parts connected rather than listed, for IT pros ramping onto Connect Sync or Cloud Sync who need one coherent production reference, and for MS-102 candidates who want depth past exam cramming, since identity synchronization sits inside the Entra identity and access domain, one of the most heavily weighted domains on that exam.

See where you are

4 questions from this guide's territory (2 easy, 2 medium), with the explanation after each. Nothing is stored and nothing is sent anywhere.

The rest of Microsoft 365 Administrator Field Guides

One product per book, a lab appendix in every one, and a companion page like this one for each.

• 
  Field guide

  Microsoft 365 Tenant Administration Field Guide

  The tenant that fails in production is rarely broken by anything exotic. It breaks on the boring interactions nobody connected.

  Kindle$12.99Get it on AmazonCompanion page

The hard set (2 questions)

The hardest MS-102 questions this guide publishes, none of them repeated from the placement quiz above: the answer first, why every other option is wrong, and the Microsoft Learn page behind it. The practice book for this exam holds the full bank.

A company is undergoing an acquisition. The acquired company has an Active Directory forest that is completely disconnected from the parent company's forest, with no forest trust or network connectivity between them. The parent company wants to synchronize users from both forests into a single Microsoft Entra tenant as quickly as possible. Which synchronization approach supports this scenario natively?

Correct answer: A. Microsoft Entra Cloud Sync with provisioning agents deployed in each forest

Microsoft Entra Cloud Sync natively supports synchronization from multiple disconnected Active Directory forests to a single Microsoft Entra tenant without requiring forest consolidation or trust relationships. Lightweight provisioning agents are deployed in each forest independently, and the cloud-based provisioning service orchestrates the synchronization. This is an explicitly stated advantage of Cloud Sync over Connect Sync, which requires forest trusts or separate complex configurations for disconnected forests.

Why the other options are wrong:

• B. Custom Metaverse join rules in Connect Sync require connectivity between forests; they cannot bridge completely disconnected forests with no network path.
• C. Staging mode is a high-availability pattern for a single Connect Sync deployment; it does not address multi-forest disconnected scenarios.
• D. Microsoft Entra Connect Sync does not natively support disconnected forests syncing to a single tenant; the feature comparison table confirms this as a Cloud Sync-only capability.

Memory hook: Disconnected forests + single tenant = Cloud Sync's home turf. Its agents are independent per forest.

Microsoft Learn: Cloud sync

You configure a Conditional Access policy that requires multifactor authentication for all users accessing SharePoint Online, and you set the policy's Enable state to Report-only. In the Sign-in logs, a user who signed in from an unmanaged browser using only a password shows the policy result 'Report-only: User action required.' What does this result indicate?

Correct answer: B. All policy conditions were satisfied, but because report-only mode never prompts for interactive controls such as MFA, success or failure could not be determined.

In report-only mode, the platform evaluates every configured condition but never enforces interactive grant controls. Because MFA is interactive and the user is never actually prompted, Microsoft Entra cannot know whether the user would have passed, so it logs 'Report-only: User action required' rather than Success or Failure.

Why the other options are wrong:

• A. An excluded user (a condition not satisfied) logs 'Report-only: Not applied,' not 'User action required.'
• C. Report-only mode never blocks or interrupts a sign-in; no control is enforced against the user.
• D. A non-interactive compliance check that failed would log 'Report-only: Failure,' and this policy required MFA, not device compliance.

Memory hook: Report-only plus an interactive control (MFA or Terms of Use) equals 'User action required' - it can't peek behind a prompt it never shows.

Microsoft Learn: Concept conditional access report only