Architecture · Cloud Architecture
Hybrid Microsoft Architecture
A reference design for organisations running Active Directory on premises alongside Entra ID, Microsoft 365 and Azure.
AdvancedUpdated 2026-09-01
Overview
The hybrid pattern synchronises identities from Active Directory to Entra ID, manages endpoints with Intune (often co managed during transition), and connects on premises networks to Azure with VPN or ExpressRoute.
The defining risk is the identity bridge. Synchronisation and authentication components sit between two Tier 0 environments, so their placement, hardening and monitoring determine whether cloud compromise can reach on premises and vice versa.
Layer model
Identity bridge
Entra Connect or Cloud Sync server (hardened, Tier 0)Chosen authentication methodPassword writeback decisionsExcluded privileged accounts
Endpoints
Hybrid joined or Entra joined devicesCo management workload splitAutopilot provisioningCompliance as an access signal
Applications
Application Proxy or ZTNA for internal appsSSO migration from ADFS or local accountsLegacy authentication retirement
Connectivity
Site to site VPN or ExpressRouteDNS resolution both directionsNon overlapping address spaceHub and spoke virtual networks
Design considerations
- Treat the synchronisation server as a domain controller equivalent, same tiering, patching and access restrictions.
- Filter synchronisation scope explicitly; do not synchronise privileged or service objects.
- Plan the retirement path for on premises dependencies rather than maintaining both indefinitely.
- Verify DNS design for split horizon resolution before migration.
Failure points
- Single synchronisation server with no documented rebuild and no monitoring of sync failures.
- Certificate expiry on federation components.
- Cloud authentication dependent on on premises availability without a fallback method.