Identity architecture, sync, MFA, Conditional Access, and privileged access controls for Microsoft 365 tenants.
A successful Microsoft 365 deployment depends on getting identity right before the first mailbox migrates. Active Directory attribute conflicts, UPN suffix mismatches, duplicate proxy addresses, and stale computer objects in the sync scope — these problems exist in almost every on-premises Active Directory environment. Found before migration, they're each a 20-minute fix. Found after migration, they're the reason users can't authenticate.
This practice starts every Microsoft 365 engagement with an Active Directory health check and Entra Connect pre-flight assessment. Problems are documented before work begins, not discovered during cutover.
Entra Connect (formerly Azure AD Connect) is the established sync tool for hybrid environments. It runs on a dedicated server on-premises, syncs every 30 minutes by default, and supports complex attribute filtering, custom sync rules, and full hybrid Exchange coexistence. If you're running a traditional hybrid Exchange deployment, Entra Connect is required.
Entra Connect Cloud Sync is the newer, agent-based alternative. It's appropriate for single-forest environments without hybrid Exchange requirements. The agent is lightweight, runs without a dedicated sync server, and supports multiple Active Directory forests to a single Entra ID tenant — something Entra Connect handles more awkwardly. The right choice depends on your Exchange coexistence requirements and Active Directory architecture. See the Entra Connect vs. Cloud Sync comparison for a detailed breakdown.
Conditional Access policies that are too broad break productivity. Policies that are too narrow defeat the purpose. The common failure mode is enabling MFA enforcement without testing every application in scope — especially legacy applications that use Basic Authentication and can't handle MFA challenges. Blocking legacy authentication at the Conditional Access layer is one of the highest-impact security improvements available in Microsoft 365. It's also the one most likely to break things if applied without a proper inventory of what's using it.
Conditional Access design work here includes a legacy authentication audit before any block policies are deployed, exclusion groups sized correctly for break-glass accounts and service accounts, and sign-in log review to verify policy coverage before enforcement is activated.
The pre-migration Active Directory assessment checks for UPN suffix issues, duplicate proxy addresses, attributes that will cause Entra Connect sync errors, stale objects in the sync scope, accounts using non-routable domains, and FSMO role health. The output is a prioritized list of issues to resolve before sync is enabled, with PowerShell remediation scripts for each category.
In most cases, yes. AD FS was the standard for federation and claims-based authentication before Entra ID matured. For organizations still running AD FS, migrating to Entra ID's native Conditional Access simplifies the infrastructure and improves reliability. The migration involves converting relying party trusts to Entra ID enterprise app registrations, which this practice handles as part of identity modernization projects.