Hybrid Identity Lab - Microsoft Entra Connect

A hybrid identity lab built with Windows Server 2022, Active Directory, Microsoft Entra Connect, and Microsoft Entra ID using Password Hash Synchronization (PHS).

This repository contains the complete setup of a hybrid identity environment, including documentation, PowerShell scripts, and screenshots captured throughout the lab.

---

Connect

• GitHub: https://github.com/Thousif1008

• LinkedIn: https://www.linkedin.com/in/mohammedthousifraza/

• Credly: https://www.credly.com/users/mohammed-thousif-raza

---

Lab Overview

This lab was built in VMware Workstation Pro using Windows Server 2022 as the domain controller and Windows 11 Pro as the client machine.

Microsoft Entra Connect was configured to synchronize the on-premises Active Directory environment with Microsoft Entra ID using Password Hash Synchronization (PHS).

The repository includes the complete implementation process, PowerShell automation, synchronization, validation, troubleshooting, and screenshots captured throughout the lab.

---

Features

• Active Directory Domain Services (AD DS)

• DNS Configuration

• Organizational Unit (OU) Management

• User Synchronization

• Group Synchronization

• Group Policy Configuration

• Microsoft Entra Connect Installation

• Password Hash Synchronization (PHS)

• PowerShell Automation

• Synchronization Validation

• Troubleshooting

---

Lab Environment

Component	Details

| Hypervisor | VMware Workstation Pro |

| Domain Controller | Windows Server 2022 |

| Client | Windows 11 Pro |

| Domain | thousiflab.com |

| Microsoft Entra Tenant | thousiflab.onmicrosoft.com |

| Synchronization Method | Password Hash Synchronization (PHS) |

---

Technologies

• Windows Server 2022

• Active Directory Domain Services

• Microsoft Entra ID

• Microsoft Entra Connect

• Microsoft 365 Admin Center

• PowerShell

• DNS

• Group Policy

• VMware Workstation Pro

---

Project Structure

Hybrid-Identity-Lab-Azure-AD-Connect

│

├── Architecture

│   └── Hybrid_Identity_Lab_Architecture.png

│

├── Documentation

│   ├── 01 - Lab Overview.md

│   ├── 02 - Lab Architecture.md

│   ├── 03 - Prerequisites.md

│   ├── 04 - Microsoft 365 Tenant.md

│   ├── 05 - Active Directory.md

│   ├── 06 - Microsoft Entra ID.md

│   ├── 07 - Entra Connect.md

│   ├── 08 - Synchronization.md

│   ├── 09 - Hybrid Identity Testing.md

│   ├── 10 - PowerShell.md

│   ├── 11 - Synchronization Health.md

│   ├── 12 - Attribute Synchronization.md

│   ├── 13 - Password Hash Synchronization.md

│   ├── 14 - Group Synchronization.md

│   ├── 15 - Troubleshooting.md

│   └── 16 - Lessons Learned.md

│

├── PowerShell

│   ├── Create-OUs.ps1

│   ├── Create-SecurityGroups.ps1

│   ├── Import-EnterpriseUsers-XLSX.ps1

│   ├── Start-ADSyncInitialSync.ps1

│   ├── Start-ADSyncDeltaSync.ps1

│   └── Get-ADSyncScheduler.ps1

│

└── Screenshots

---

Documentation

The complete implementation guide is available in the Documentation folder.

Document	Description

| 01 - Lab Overview | Project overview |

| 02 - Lab Architecture | Lab architecture and components |

| 03 - Prerequisites | Software and environment requirements |

| 04 - Microsoft 365 Tenant | Microsoft 365 tenant setup |

| 05 - Active Directory | Active Directory configuration |

| 06 - Microsoft Entra ID | Microsoft Entra ID preparation |

| 07 - Entra Connect | Microsoft Entra Connect installation and configuration |

| 08 - Synchronization | Initial and Delta synchronization |

| 09 - Hybrid Identity Testing | Hybrid identity validation |

| 10 - PowerShell | PowerShell commands and scripts |

| 11 - Synchronization Health | Synchronization health checks |

| 12 - Attribute Synchronization | Attribute synchronization |

| 13 - Password Hash Synchronization | Password Hash Synchronization |

| 14 - Group Synchronization | Group synchronization |

| 15 - Troubleshooting | Common issues and resolutions |

| 16 - Lessons Learned | Key takeaways from the lab |

---

PowerShell Scripts

The following scripts were used to automate common Active Directory and Microsoft Entra Connect tasks.

Script	Description
Create-OUs.ps1	Creates the Organizational Unit (OU) structure.
Create-SecurityGroups.ps1	Creates department security groups.
Import-EnterpriseUsers-XLSX.ps1	Imports users from Excel into AD. Supports -WhatIf for testing, generates random passwords, and saves a CSV report after each run.
Start-ADSyncInitialSync.ps1	Starts an Initial Synchronization cycle.
Start-ADSyncDeltaSync.ps1	Starts a Delta Synchronization cycle.
Get-ADSyncScheduler.ps1	Displays the Microsoft Entra Connect synchronization schedule.

Note: the import script used to use one fixed password if a row was missing one. Changed it to generate a random password per user instead, since reusing the same password isn't good practice. Also added -WhatIf so you can preview what the script will do before it makes any changes.

---

Implementation

VMware Workstation

The lab environment was created in VMware Workstation Pro with separate virtual machines for the domain controller and Windows 11 client.

---

Active Directory

The Active Directory environment includes Organizational Units (OUs), department users, security groups, DNS configuration, and Group Policy.

---

Microsoft Entra Connect

Microsoft Entra Connect was installed and configured to synchronize the on-premises Active Directory environment with Microsoft Entra ID using Password Hash Synchronization (PHS).

---

Initial Synchronization

After the initial synchronization completed, the on-premises Active Directory users appeared in Microsoft Entra ID.

---

Hybrid Identity Validation

A new user was created in Active Directory to verify synchronization.

User created in Active Directory

After running a Delta Synchronization, the same user appeared in Microsoft Entra ID.

User synchronized to Microsoft Entra ID

---

PowerShell

PowerShell was used to trigger synchronization cycles and verify the Microsoft Entra Connect scheduler.

---

Skills Demonstrated

• Windows Server 2022 Administration

• Active Directory Domain Services (AD DS)

• Microsoft Entra ID

• Microsoft Entra Connect

• Hybrid Identity

• Password Hash Synchronization (PHS)

• DNS Management

• Group Policy Management

• Organizational Unit (OU) Administration

• User and Security Group Management

• PowerShell Automation

• Identity Synchronization

• VMware Workstation Pro

• Windows Client Administration

• Troubleshooting

---

References

The following Microsoft Learn resources were used during the implementation of this lab.

• Microsoft Learn – Active Directory Domain Services: https://learn.microsoft.com/en-us/training/modules/introduction-to-ad-ds/

• Microsoft Learn – Microsoft Entra ID: https://learn.microsoft.com/entra/

• Microsoft Learn – Microsoft Entra Connect: https://learn.microsoft.com/entra/identity/hybrid/connect/

• Microsoft Learn – Password Hash Synchronization (PHS): https://learn.microsoft.com/entra/identity/hybrid/connect/whatis-phs

• Microsoft Learn – PowerShell Documentation: https://learn.microsoft.com/powershell/