PRACTICE / MODULE 011 / MICROSOFT

One employee.
Two identity planes.

Northstar's existing Active Directory meets its Microsoft Entra tenant. Diagnose a missing synchronized identity, then restore Kerberos file access and Group Policy on a hybrid Windows workstation.

← Review hybrid identity fundamentals Previous · Intune Fundamentals →

03 / INTERACTIVE HYBRID INVESTIGATION

Investigate Jordan Reyes and OPS-LT022.

Compare AD DS with its synchronized cloud representation, then investigate Windows AD DNS, time, Kerberos and Group Policy. Capture failures and verify each repair before closing.

JOELEarns / NORTHSTAR SERVICESHybrid Identity Windows + Microsoft Entra

SIMULATED / NO LIVE AD OR ENTRANS-2204 / OPEN

ACTIVE INVESTIGATIONJordan ReyesOn-premises AD-sourced user

MODELED CHECKS4 / 7Current prerequisite status

TICKETS RESOLVED0 / 2Local browser progress

SIMULATED RESULTNorthstar runs Microsoft Entra Connect Sync. Observe the provisioning evidence before changing directory scope.

ACTIVE DIRECTORY / AUTHORITATIVE DIRECTORY

Jordan Reyes

Northstar maintains this employee's identity in on-premises AD DS. Entra only receives the configured synchronized representation.

Jordan Reyesjordan.reyes@northstar.example.testOU=Operations-Archive · northstar.internal

AD-SOURCED

Authoritative AD DS user object

The employee record exists in AD DS. Removing it would not repair missing cloud provisioning.

Enabled / present

NS-Inventory-Users (AD security group)

Jordan's approved membership allows access to the Inventory Portal when the group and its membership are synchronized and mapped to the application.

Enabled / present

Read-only evidence

Get-ADUser -Identity jreyes -Properties DistinguishedName,UserPrincipalName

Compare the source OU, UPN, expected object and whether the user is cloud-only or on-premises sourced.

SIMULATED EVENT LOG1 events

TICKET
NS-2204 opened: Jordan Reyes exists in AD DS but is missing from Entra ID.

SESSION TICKET NOTESFictional data only

Copy the current diagnostic model. No directory, account or real infrastructure is modified.

JOELEarns / NORTHSTAR SERVICES / FICTIONAL HYBRID IDENTITY
Ticket: NS-2204
Phase: directory
Identity: Jordan Reyes / AD-sourced / Northstar
Directory object present: true
Approved OU scope: false
Connect Sync service: true
Verified UPN suffix: true
Entra identity provisioned: false
Cloud group membership: false
AD-aware DNS: false
Domain controller reachable: true
Client clock deviation (minutes): 9
Kerberos service SPN valid: true
Share permission approved: true
GPO applied: false
PASS / AD DS source: Jordan's on-premises user object is present in AD DS.
FAIL / Approved sync scope: Jordan is in an excluded OU; the configured Connect Sync scope omits this object.
PASS / Synchronization service: Connect Sync is available to process the modeled change.
PASS / Verified cloud sign-in suffix: Jordan uses the organization's verified cloud UPN suffix.
FAIL / Entra identity: No confirmed synchronized Entra object; correct source/scope/errors, then inspect a completed cycle.
FAIL / Cloud app entitlement: Cloud app entitlement isn't complete; compare AD group, synchronized membership and app assignment.
PASS / Identity safeguards: Northstar's MFA requirement remains enabled.
NOTE: A fictional training exercise. No AD DS, Entra, passwords, group memberships or devices were changed.

KEEP THE LAYERS DISTINCT

Synchronized isn't authenticated. Authenticated isn't authorized.

Directory scoping, cloud authentication, domain tickets, resource ACLs and Group Policy require distinct evidence.

Review hybrid identity lesson →Related Intune →Northstar onboarding →