How do you give users one identity across on-prem Active Directory and Azure (hybrid identity)?
What they are really testing: Senior identity signal: knows Entra Connect syncs on-prem AD to Entra and the authentication options (password hash sync, pass-through, federation) with their trade-offs. Ties the on-prem and cloud identity worlds together.
A real interview question
How do you give users one identity across on-prem Active Directory and Azure (hybrid identity)?
What most people say
drag me
“I would recreate all the users in Entra ID so they exist in both places.”
Manually recreating users means two disconnected identity stores that drift and double the admin work. Hybrid identity is solved by syncing on-prem AD into Entra with Entra Connect, with a deliberate authentication method.
The follow-ups they ask next
Why is password hash sync usually preferred over federation?
It is far simpler to operate and more resilient, cloud auth keeps working even if on-prem is down, with no ADFS infrastructure to maintain. Federation adds significant complexity and an on-prem dependency, justified only by specific requirements.
What is the trade-off with pass-through authentication?
Passwords are never stored in the cloud (a compliance plus), but cloud sign-in depends on the on-prem agents and AD being available, so an on-prem outage can block cloud authentication.
What the interviewer is listening for
- Syncs with Entra Connect, not recreate
- Knows password hash sync / pass-through / federation trade-offs
- Defaults to hash sync, federation only when needed
What sinks the answer
- Manually recreates users in both
- Unaware of Entra Connect
- Cannot compare the auth methods
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“One identity via [syncing, not recreating: Entra Connect synchronizes on-prem AD users/groups into Entra for SSO]. Auth options: [password hash sync (simplest, recommended, resilient if on-prem is down), pass-through (validates against on-prem in real time, password never in cloud, but depends on on-prem), federation/ADFS (full control, most complex)]. Default to [hash sync], escalate only [for specific compliance needs].”
Keep going with azure
Foundation
What is Microsoft Entra ID (formerly Azure AD), and how does authentication work in Azure?
Foundation
In Azure, what handles authentication versus authorization?
Foundation
Explain the Azure resource hierarchy: tenant, management group, subscription, resource group.
Junior
How does Azure RBAC work? Explain roles, scopes, and assignments.
Junior
What happens when a user signs in to an Azure/Entra-protected application?
Junior
What is the difference between a service principal and a managed identity, and why prefer managed identities?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free