The Entra role for managing federation, PHS, PTA, cloud sync and Entra Connect settings. It is the cloud role with the least privilege that still covers Entra Connect.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Hybrid Identity Administrator in context, with comparison tables and the common traps.
Terms in this definition
- Role
How an actor normally or expectedly behaves, or the part a person takes in a process. A single actor may hold more than one role.
- Federation
An arrangement in which separate identity providers trust one another, letting people use the account from their home organisation to reach services in another domain. In a hybrid setup, Entra ID can pass sign-ins over to a federation service like AD FS.
- Password hash sync
Sign-in option in Microsoft Entra Connect that copies password hashes to the cloud, so Microsoft Entra ID itself handles authentication and lockout.
- Pass-through Authentication
Sign-in option in Microsoft Entra Connect where agents running on-premises, using outbound port 443 only, check passwords against AD. No password hashes are kept in the cloud.
- Microsoft Entra Connect
Keeps Microsoft Entra ID in step with an on-premises Active Directory by synchronising its identities to the cloud.
- Least privilege
The security practice of giving each task only the permissions it requires, scoped as narrowly as possible.