JUMP TO SECTIONChoose a lesson section
Trace the evidence, not just the product name.
In production, the same user can have correct directory permissions but fail a resource entitlement, or sign in with Windows Hello while lacking on-premises Kerberos access. This clinic focuses on configuration decisions, negative tests, troubleshooting artifacts and safe rollback across the identity control plane.
One role label doesn't describe effective permissions
Scope the actual administratorEntra RBAC has role definitions (supported actions) and assignments (a principal plus scope). Built-in roles cover common tasks; custom roles support selected directory resource actions when needed. An administrative unit can scope compatible role actions, but a second tenant-wide or active PIM role remains effective.
PROVE: Inspect all standing and active role assignments, principal/group memberships and scopes. Test a permitted and a denied operation.Account creation is not resource access
Trace identity ownershipCustom domains must be verified through Microsoft's DNS ownership process before adoption. Tenant controls for collaboration, allowed partner domains, device registration and default user settings affect different actions. Inviting a guest or verifying a domain never creates the application's assignment.
PROVE: Verify domain state, inviter permissions, partner restrictions, guest redemption, app assignment and CA results independently.Cloud Sync and Connect Sync have overlapping—not identical—capabilities
Choose sync technology by requirementCloud Sync's light agent and cloud-managed configuration fit many deployments, including supported disconnected-forest scenarios. Connect Sync retains advanced custom sync rule and cross-forest merge capabilities. Current guidance also adds features over time, so verify each proposed synchronization, filtering, join and device scenario against Microsoft documentation.
PROVE: Inventory forests, source-of-authority, object joins and mappings. Test a small pilot with attribute mapping and rollback.PHS, PTA and Seamless SSO serve different purposes
Separate password validation from SSOPassword Hash Synchronization (PHS) supports cloud-side credential validation after additional cryptographic hash processing. Pass-through Authentication (PTA) sends authentication validation to healthy on-prem agents. Seamless SSO is a user convenience for supported corporate environments and works with PHS/PTA; it isn't a third directory sync engine or an automatic PTA failover.
PROVE: Check the configured sign-in method, sign-in logs, agent state (if PTA), SSO policy/browser prerequisites and tenant rollback.A working device unlock is not proof of Kerberos or app access
Troubleshoot device-to-resource trustWindows Hello for Business uses device-bound cryptographic credentials protected by a gesture. Hybrid SSO depends on the supported cloud/key/certificate trust model. Microsoft Entra Kerberos cloud trust needs device/PRT state, policy, and on-prem AD DS prerequisites. Conditional Access sign-in frequency is distinct from revoking sessions and CAE critical-event checks.
PROVE: Review dsregcmd /status join/PRT/OnPremTgt and CloudTgt signals with OS-version naming, on-prem tickets, DC reachability and targeted sign-in controls.The administrator's effective scope is the union of all their grants.
For an actual change, record the principal, each role definition and the assignment scope. Distinguish Microsoft Entra directory roles from Azure resource RBAC and app-specific roles. A custom role should name only necessary supported directory resource actions, and it still needs a carefully scoped assignment.
Find every route to an administrator grant
Inventory direct Entra role assignments, role-assignable groups, Azure RBAC (a different scope), active/eligible PIM roles and any custom role definitions.
Evaluate the supported actions
Confirm whether the task needs a built-in directory role or selected supported custom role resource actions. Don't grant broad Global Administrator just because one narrow action fails.
Verify the assignment scope
Confirm tenant scope, compatible administrative unit membership or other supported resource scope. A group object in an AU does not automatically scope all group members as users.
Prove allowed and denied actions
Test with a permitted and out-of-scope user or resource. Review audit logs and effective PIM role state before calling least privilege complete.
Invited doesn't mean approved, assigned or authorized.
Start at the authoritative source. Custom sign-in suffixes must be verified, and AD DS–sourced users should be changed at the correct identity source. External collaboration policy governs who can invite and which domains are permitted. Resource access then requires its own cross-tenant, app assignment and Conditional Access evaluation.
Confirm verified domain and source of authority
Check domain DNS ownership verification and whether an identity is cloud-only or synchronized from AD DS. Change the authoritative source to avoid creating a duplicate.
Review invitation and external collaboration rules
Check which directory roles and user settings permit invitations, partner allow/block rules and any related inbound/outbound cross-tenant policy.
Prove the guest's resource path
Inspect invitation redemption status, user type, enterprise app access, Conditional Access result and whether the guest can perform the intended resource operation.
Close the lifecycle loop
Use sponsorship, project end dates, access reviews and governance workflows. When access ends, remove entitlements or disable the external account as approved and verify the resource denies access.
Don't migrate a synchronization engine without checking what it actually supports.
Cloud Sync now covers many user, group and device scenarios, including selected disconnected forests. Connect Sync still supports advanced rule and object-join needs. Separately decide whether the organization uses PHS, PTA or federation for authentication, then whether Seamless SSO adds a supported user experience. These are not substitutes for one another.
Cloud Sync
Lightweight on-prem provisioning agents; Entra-managed config, scoped mappings and supported disconnected forests
Check feature matrix for advanced joins, custom rules, device sync, object filtering and migration constraints.Connect Sync
On-prem synchronization engine with advanced sync rules and complex source joins
Check connectors, filtering rules, matching, export/duplicate errors, source-of-authority and server health.Password Hash Sync
Cloud sign-in using further-processed AD DS password hash material
Validate sync freshness, account state and intended CA; not plaintext password copying or live PTA agent validation.Pass-through Authentication
Cloud sign-in validation through available on-prem authentication agents
Check agent status/egress, on-prem AD DS health and supported redundancy. Failover to PHS is not automatic.Seamless SSO
A Kerberos-based sign-in convenience for supported corporate clients with PHS/PTA
Check the supported browser, corporate network, site zone/policy and Kerberos identity ticket path.Microsoft documents distinct agent availability and fallback behavior. Verify the configured authentication method before changing server infrastructure, and prepare an approved recovery path.
The unlock, the cloud token and the file-share ticket are different proofs.
Windows Hello for Business protects a device-bound credential; PIN unlock is not a cloud password check. With a supported hybrid cloud trust design, a user also needs the right ticket paths to access on-premises resources. Use read-only diagnostics such as dsregcmd /status, approved sign-in logs and safe test resources to prove each layer. Don't confuse Conditional Access sign-in frequency with CAE or administrative session revocation.
Device and registration
Is the device truly Entra joined/hybrid joined as expected?
Use dsregcmd /status and confirm join/registration indicators, plus enrollment/compliance separately.Primary Refresh Token
Can the signed-in user acquire the expected cloud SSO state?
Confirm AzureAdPrt and inspect sign-in/device diagnostics. PRT alone doesn't guarantee an on-prem Kerberos ticket.Cloud Kerberos trust
Are cloud Kerberos issuance and configured policies functioning?
On newer Windows, inspect OnPremTgt for the on-prem referral and CloudTgt for cloud access; verify OS-version labels, trust policy, DC connectivity and a real AD DS service ticket.Conditional Access session
Did the app actually evaluate the intended sign-in frequency/session control?
Review sign-in/Conditional Access results and supported client/resource session behavior. CAE and session revocation are separate.In Windows 11 version 23H2 and later, OnPremTgt refers to the on-premises referral/partial ticket while CloudTgt refers to the cloud ticket. Earlier Windows diagnostics used CloudTgt for the on-prem field. A partial ticket still needs DC exchange for a full AD DS TGT and resource-specific authorization. Check the operating system version and real service access rather than treating a single YES as completion.
Four guided checkpoints. Decisions and evidence are simulated locally; nothing connects to your tenant.
Northstar has Microsoft Entra joined Windows 11 laptops, synchronized AD DS users, writable DCs and an on-prem SMB share. The team does not need certificate-based authentication. Which WHfB trust model fits the pilot?
- Existing AD DS and cloud identities are synchronized.
- Users must reach a Kerberos-protected file share after WHfB sign-in.
- No requirement for user certificate authentication has been identified.
The four-step Learn exercise introduces the troubleshooting boundaries. Practice 022 now offers two separate investigations: a Windows Hello for Business pilot rollout and a Microsoft Entra Kerberos deployment with protected-account, ticket and key-maintenance decisions.
Open the hybrid trust deployment clinic →Record an approved user, a deliberately out-of-scope user, exact policies/roles, the relevant identity/connector/Windows diagnostics and the result after remediation. Avoid storing credentials, recovery secrets or unnecessary personal data in ticket notes.
What would you check next?
Four original practice investigations isolate the most commonly confused layers: administrator scope, external guest authorization, sync platform compatibility and Windows hybrid Kerberos.
Four evidence trails. Never assume one green status proves the next layer.
Select a ticket and choose a defensible first investigation. Each case uses fictional data.
A regional help desk admin still resets users outside their AU.
AVAILABLE EVIDENCE
- The listed role is Helpdesk Administrator at Tidewater AU scope.
- An operator performed a successful password reset on a West Coast user.
- The operator may have other tenant-wide or activated role grants.
Use the current support matrix before your next change.
Turn a green dashboard into proven access.
Practice 022 adds 16 flashcards, 16 explained questions and two four-step Northstar operations tickets.