Hybrid Identity Design¶
Atlanta, USA
Last updated: 2026-08-04
Objective¶
Create a resilient identity model where users access cloud and on-premises resources through a consistent authentication and authorization framework.
Source: What is hybrid identity with Microsoft Entra identifier service?.
Design decisions¶
| Decision area | Guidance |
|---|---|
| Identity source of truth | Define authoritative identity attributes and lifecycle source |
| Synchronization model | Define provisioning and synchronization scope and cadence |
| Authentication model | Choose cloud-native, pass-through, or federated pattern based on constraints |
| Cutover model | Pilot by cohort before large-scale authentication cutover |
Migration stages¶
- Baseline current identity dependencies.
- Clean directory data and naming conflicts.
- Pilot synchronization and sign-in pathways.
- Enable policy controls and conditional access stages.
- Decommission legacy dependencies after proof.
Risks to control¶
- Duplicate identities and inconsistent immutable attributes.
- Overlapping legacy and new access policies.
- Missing rollback path for authentication changes.