Directory Synchronization

Entra Connect Sync

Pre-requisites

A note on Entra Single Sign-On

To achieve single sign-on, meaning users who sign in at the Windows logon screen (Ctrl+Alt+Del) should *not* be prompted again when accessing Entra ID–authenticated applications. The delivery method depends on the scenario.

Scenario	How Entra SSO can be delivered
Hybrid Entra Joined Windows 10/11	Windows obtains a Primary Refresh Token (PRT) at workstation sign-in.
Domain-joined but not hybrid-joined Windows 10/11	No PRT from the Windows sign-in. Seamless SSO (requirements below) gives browser and Office SSO. If the user adds the work account under Settings > Accounts > Access work or school, the device becomes Entra registered and WAM obtains a PRT for that account.
Legacy Windows 7/8.1 or Server 2008R2-2012R2	OS doesn't support PRT. Seamless SSO can help (see Seamless SSO requirements below).
Mac/Linux or non-WAM browsers
Chrome 111 or later on Windows	Native call-out to WAM through the CloudAPAuthEnabled policy: HKLM\SOFTWARE\Policies\Google\Chrome, CloudAPAuthEnabled = DWORD 1.
Chrome without that policy, or Chrome on macOS	Microsoft Single Sign On extension (ppnbnpeolgkicgegkbkbjmhlideopiji), pushed with ExtensionInstallForcelist; on macOS it needs the Enterprise SSO plug-in.

GCC High

Seamless SSO autologon endpoint: Add https://autologon.microsoft.us to the Intranet Zone and outgoing allow list.

Commercial

Seamless SSO autologon endpoint: Add https://autologon.microsoftazuread-sso.com to the Intranet Zone and outgoing allow list.

Seamless SSO requirements: Add the environment-specific autologon endpoint (above) to the Intranet Zone and outgoing allow list, enable the intranet zone policy Allow updates to status bar via script through Group Policy, and use client versions 16.0.8730.xxxx or later.

A note on licensing

Users may require multiple accounts to support lab and writing environments. Microsoft's "one license per human" policy may help:

• Alex Simon's One-License-Per-Human Post

GCC High

GCC High Considerations

• Use a supported Microsoft Entra Connect 2.x release: every 1.x build is retired and no longer synchronizes, and each 2.x build retires 12 months after the next one ships. Upgrade to 2.6.84.0 or later and configure application-based authentication before April 7, 2027, when legacy authentication retires and synchronization stops. Check the version history before every install; the Azure Government page still quotes a 1.x minimum.
• If your firewall or proxy allows DNS unblocking, unblock *.msappproxy.us URLs over port 443.
• If not, allow access to the Azure datacenter IP ranges, which are updated weekly.

Commercial

No corresponding requirement for Commercial tenants.

Confirm UPN alignment with email addresses

Having routable UPNs for users that match their email addresses avoids headaches down the line.

Staged Rollout To Managed Auth (confirm no federation)

When a tenant uses federated authentication, Staged Rollout allows migration to managed authentication incrementally rather than requiring a big bang cutover.

Entra Hybrid Join

Entra Connect is required if configuring Entra Hybrid Join.

Password Hash Sync

Password Hash Sync is the recommended sign-in method, and it stays on even when the tenant signs in through Pass-through Authentication or federation: it is what feeds leaked-credential detection in ID Protection for synchronized accounts, and it is the fallback sign-in method when the federation service or the pass-through agents are unreachable (the failover is manual, in the Entra Connect wizard). Hybrid join needs Entra Connect, not Password Hash Sync; the two are configured separately.

Password Writeback

Configure Password Writeback when Self-Service Password Reset must update a synchronized user's on-premises AD password. Cloud-only users do not need writeback.

Self-Service Password Reset

Self-service password reset reduces helpdesk costs and enables secure password recovery.