Microsoft AZ-801: Identity and Access Management for Hybrid Environments — Study Guide

By Laurynas Brazys · 7 August 2026 · #microsoft #az-801 #certification #exam-prep #study-guide

Part of the Microsoft Windows Server Hybrid Administrator Associate AZ-801 — Study Guide. Practice with verified answers in the Microsoft exam hub, or take timed practice tests on ExamRoll.io.

Overview

Identity and access management in hybrid environments hinges on a consistent control plane across on-premises Active Directory Domain Services (AD DS) and Microsoft Entra ID. The core building blocks are directory synchronization and health monitoring, device identity and single sign-on, secure federation or reverse-proxy publishing for legacy apps, and just-in-time governance for privileged roles and external users. Effective designs incorporate Azure AD Connect (now Microsoft Entra Connect sync), Azure AD Connect Health, Hybrid Azure AD Join with troubleshooting discipline, Seamless SSO, AD FS when federation is required, Azure AD Application Proxy with Kerberos Constrained Delegation for on-premises apps, strong Conditional Access policy, Azure AD Password Protection on domain controllers, and Microsoft Entra ID Governance including PIM and entitlement management.

Azure AD Connect and Health in Hybrid Identity

Azure AD Connect is the authoritative synchronization engine between AD DS and Microsoft Entra ID. Correctly scoping, transforming, and writing attributes is critical.

Password writeback extends self-service password reset (SSPR) and password change in the cloud back to on-premises AD. It requires Microsoft Entra ID P1/P2, SSPR enabled in the tenant, outbound HTTPS from the sync server, and the Azure AD Connect sync service account with the proper reset permissions in AD. When enabled, users who reset passwords in Entra receive immediate enforcement in AD DS, with rules honoring AD password policies.

Device writeback creates msDS-Device objects in AD DS for devices registered in Entra. This supports on-premises conditional access in AD FS and certain Windows Hello for Business certificate trust scenarios. Requirements include a Windows Server 2012 R2 schema or later, Enterprise Admin rights to create the RegisteredDevices container, and Azure AD Connect configured to target the correct forest and OU. The sync service account receives delegated rights on that container.

Group writeback synchronizes Microsoft 365 groups back to AD DS as mail-enabled groups for on-premises address lists and ACLs. Group writeback v2 allows scoping to a specific OU and preserves membership with better fidelity. For mail features, Exchange hybrid is recommended. Administrators should not modify cloud-origin group attributes on-premises; treat writeback as authoritative from Entra.

Synchronization rules determine object scope, joins, and attribute flows. Use the Synchronization Rules Editor to create custom inbound or outbound rules with higher precedence (lower numeric value) rather than modifying built-ins. Define scoping filters (for example, only sync users with a specific attribute), join rules (how cloud and on-prem objects correlate—immutableId/sourceAnchor consistency is key), and transformations (normalize UPNs, map extension attributes). Restrict synchronization using domain/OU filtering or attribute-based filtering to minimize data exposure and reduce error surface.

Azure AD Connect Health provides continuous monitoring for AD DS, AD FS, and AAD Connect. Install the Health agents on domain controllers, AD FS/WAP servers, and the sync server. The portal surfaces:

• Sync errors and alerts: export errors (ConstraintViolation, ObjectTypeMismatch), duplicate attribute resiliency events, password hash sync failures, delta sync issues, and scheduler health.
• AD FS analytics: token issuance errors, certificate expiration, trust metadata freshness, latency to relying parties, and anomalies such as high extranet lockouts.
• AD DS analytics: replication backlog, FSMO role health, secure channel failures, and NTLM deprecation insights. Consistently investigate errors at the stage where they occur (import, synchronization, export) using the Synchronization Service Manager and correlate with Connect Health alerts. Use usage analytics to right-size infrastructure and detect abnormal sign-in or token issuance patterns.

Device Identity and Single Sign-On

Hybrid Azure AD Join (HAADJ) binds domain-joined devices to Entra, enabling PRT-based SSO and device-based Conditional Access. Requirements include verified custom domains in Entra, SCP configuration in AD (Azure AD Connect can configure this per forest), device registration enabled in Entra, and outbound access to device registration endpoints. Windows 10/11 and Windows Server 2016+ support automatic hybrid join when they have line-of-sight to a domain controller or appropriate network reachability. Downlevel devices historically required AD FS/Workplace Join, but modern deployments standardize on supported client OS versions.

The join process relies on the device discovering the tenant via the SCP in the Configuration partition, contacting enterpriseregistration endpoints, authenticating with the machine account, and registering a device object in Entra. Successful registration results in a Primary Refresh Token (PRT) enabling SSO to modern applications. Troubleshoot with dsregcmd:

• dsregcmd /status confirms AzureAdJoined = YES and DomainJoined = YES, and surfaces PRT status, TenantId, and error codes.
• Review the User Device Registration event log (Applications and Services Logs) for DRS and authentication failures.
• Validate time synchronization, proxy exclusions for device registration endpoints, SCP correctness, and that device writeback (if used) created the AD container with proper permissions. If needed, dsregcmd /leave clears registration to allow a clean join attempt.

Azure AD Seamless SSO provides integrated Windows authentication to Entra without AD FS. Enabling SSO in Azure AD Connect creates the AZUREADSSOACC computer account in AD and sets the SPNs (HTTP/autologon.microsoftazuread-sso.com). Domain controllers issue a Kerberos service ticket for this SPN when browsers access the autologon endpoint; Entra validates the ticket using the shared key stored securely in the tenant. Supported clients include Microsoft Edge and Internet Explorer with the Entra endpoints in the Local Intranet zone, Google Chrome via Windows Integrated Authentication policy, and Firefox with negotiate configuration. Devices must be domain-joined and on the corporate network (or connected over VPN) to present Kerberos tickets; private browsing modes can disable WIA. Keys on AZUREADSSOACC are rotated automatically; do not reset them manually. Seamless SSO works with both Password Hash Sync and Pass-through Authentication.

Federation, Application Publishing, and Secure Access

Active Directory Federation Services remains relevant where organizations need claim enrichment, smartcard or certificate auth, or pre-existing federation contracts. In AD FS, a claims provider trust represents an inbound identity source (typically Active Directory or a partner IdP). A relying party trust represents an application relying on AD FS tokens (for example, Microsoft 365 in federated mode or a SAML app). Claims issuance rules transform incoming attributes into the tokens expected by the relying party; use the claims rule language or the rule templates to author policy with least privilege. Keep token-signing and token-decrypting certificates healthy and automate rollover where possible. Web Application Proxy (WAP) publishes AD FS externally, validates the AD FS proxy trust, and terminates TLS at the edge; monitor WAP health and ensure endpoint whitelists and certificate renewal are automated.

For modernizing access to on-premises web apps, Azure AD Application Proxy provides cloud pre-authentication and integrates with Conditional Access. Deploy connectors on domain-joined Windows Server hosts with outbound-only HTTPS to the service. Use connector groups to segment apps by network zone, latency, or data residency, and to provide isolation for high-risk apps. Choose pre-authentication with Azure AD to enforce MFA, device compliance, sign-in risk, and group membership before traffic reaches the datacenter; pass-through pre-auth should be reserved for scenarios where the app handles authentication and Conditional Access is not required. For SSO to Integrated Windows Authentication apps, configure Kerberos Constrained Delegation (KCD) on the connector’s computer account to the target SPN (HTTP/app-server). The connector obtains a Kerberos ticket on behalf of the user and presents it to the application, enabling seamless SSO from the internet while maintaining least privilege delegation. Validate SPNs, ensure the connector can reach KDCs and the backend app, and restrict delegation only to required services.

Conditional Access enforces risk- and posture-aware policy across cloud and published on-premises apps. Combine signals such as device state (Require device to be marked as compliant) and directory state (Require Hybrid Azure AD joined device) to gate access for managed endpoints. Leverage sign-in risk from Identity Protection to block or require MFA for anomalous sign-ins. Apply policy to Azure AD Application Proxy–published apps with Azure AD pre-authentication; for AD FS–federated apps, replicate intent via AD FS claims rules or migrate to cloud pre-auth. Exclude break-glass accounts and service principals, and test policy in report-only mode before enforcement.

Privileged Access, Password Protection, and Governance

Azure AD Password Protection eliminates weak credentials by combining Microsoft’s global banned password list with a custom organizational list. Deploy the Azure AD Password Protection proxy service on one or more member servers to broker DC connectivity to the cloud, and install the DC agent on every writable domain controller to enforce policy at password set/change. The agents pull the current policy over HTTPS, and enforcement can run in audit mode before switching to enforce. The algorithm evaluates variants and common substitutions; monitor the dedicated event logs for rejections and auditing. This integrates with SSPR password writeback so the same rules apply everywhere.

Privileged Identity Management (PIM) operationalizes least privilege through eligible assignments and just-in-time activation. Assign high-impact roles (Global Administrator, Privileged Role Administrator, Security Administrator) as eligible, not permanent. Configure activation requirements such as MFA, ticket or justification, approval workflow with designated approvers, time-bound activation, and optional Azure AD Conditional Access at activation. PIM for Groups extends JIT access to membership/ownership of privileged access groups, which can in turn be assigned to Azure AD roles or Azure RBAC. Use access reviews to recertify role and group membership on a cadence, requiring resource owners to attest or revoke access automatically when users are inactive or change departments. Alerts identify standing privileged accounts, and audit logs capture every activation and approval for compliance.

Microsoft Entra ID Governance entitlement management curates access packages that bundle resources (groups, SharePoint sites, and applications) with lifecycle and approval policies. Define who can request access (internal users, specific departments, or external users from connected organizations), set multi-stage approvals, require business justification, and enforce expiration with access reviews at end-of-life. Connected organizations model partner domains and identity providers to streamline B2B onboarding with appropriate terms of use and lifecycle automation. Users request access via the My Access portal, and upon expiration, resources are removed automatically to minimize standing access.

Practical Problem Scenario

Siemens AG is migrating legacy on-premises web applications to modern access while maintaining AD DS and introducing least privilege. Users complain about repeated credential prompts for Microsoft 365 and internal apps, and auditors require time-bound administrative access and strong password hygiene.

1. Establish hybrid identity and SSO

• Deploy Microsoft Entra Connect sync with Password Hash Sync, enable Seamless SSO. This reduces prompts by allowing Kerberos-based SSO through the AZUREADSSOACC account without requiring AD FS. Configure OU filtering and custom sync rules to scope only required objects and normalize UPNs.

2. Enable device trust and Conditional Access

• Configure Hybrid Azure AD Join via Azure AD Connect to register domain-joined Windows clients. This provides device-based signals for Conditional Access. Validate registration with dsregcmd /status and remediate SCP or proxy misconfigurations surfaced in the User Device Registration log.

3. Publish on-premises apps securely

• Deploy Azure AD Application Proxy connectors in two datacenters and place apps into connector groups by locality. Use Azure AD pre-authentication so Conditional Access enforces hybrid-join or compliance and MFA at the edge. Configure KCD on connector machine accounts for IWA apps, restricting delegation to specific SPNs to achieve internet SSO with least privilege.

4. Harden passwords end to end

• Install Azure AD Password Protection proxy service on redundant member servers and the DC agent on all writable domain controllers. Enable enforce mode with a custom banned password list reflecting Siemens-specific terms. This ensures consistent rejection of weak passwords both on-premises and via SSPR with password writeback.

5. Modernize privileged access

• Implement PIM with eligible assignments for Global Administrator, Privileged Role Administrator, and critical Azure RBAC roles. Require MFA, justification, and one-stage approval, with 4-hour activation windows. Configure quarterly access reviews for all privileged roles and privileged access groups, automatically removing inactive or unapproved assignments.

6. Monitor and operate

• Install Azure AD Connect Health agents on the sync server, AD FS/WAP (if still used for specific partners), and domain controllers. Use health alerts to track sync errors, password hash sync status, AD DS replication health, and AD FS token issuance anomalies. Leverage usage analytics to right-size connector capacity and detect abnormal spikes.

This approach eliminates unnecessary federation, centralizes policy with Conditional Access, and uses KCD to modernize legacy app access. Seamless SSO and HAADJ remove password prompts, Password Protection enforces strong credentials at the source, and PIM plus access reviews deliver auditable, just-in-time administrative access aligned to least privilege.

← Disaster Recovery and Business Continuity · All domains

Practice these questions → · Timed practice on ExamRoll.io →

Browse Microsoft →