What's changed: Created MS-102 Chapter 2 (domain: Microsoft Entra identity and access): identity synchronization (IdFix pre-remediation, Microsoft Entra Connect Sync vs Cloud Sync, Connect Health monitoring, troubleshooting), authentication (authentication methods, SSPR, Password Protection global/custom banned lists, password writeback), and secure access (Identity Protection risk detection and risk policies, Conditional Access signals and grant/block, enforcing MFA via Conditional Access, require compliant device).
2.1Identity synchronization
Understand syncing on-prem AD with Microsoft Entra ID: IdFix for pre-sync error remediation, choosing between Microsoft Entra Connect Sync and Cloud Sync, monitoring with Microsoft Entra Connect Health, and troubleshooting sync.
In hybrid identity, you sync on-prem Active Directory users to Microsoft Entra ID. Design in order: clean the data, choose the sync engine, then monitor.
2.1.1Pre-sync remediation with IdFix
Before syncing, use IdFix to detect and fix formatting errors and duplicates in on-prem AD (invalid UPNs, duplicate proxy addresses, illegal characters). Syncing dirty data causes errors, so use it as a pre-sync cleansing tool.
2.1.2Connect Sync vs Cloud Sync
Microsoft Entra Connect Sync is the traditional server-resident sync supporting complex requirements: advanced filtering, attribute transformation, password writeback, device writeback. Microsoft Entra Cloud Sync uses a lightweight agent with configuration in the cloud, suited to multiple disconnected forests and small-to-medium/simple needs (highly available agents, low server load). Choose by requirement complexity.
2.1.3Monitoring and troubleshooting
Microsoft Entra Connect Health monitors the health and sync errors of sync and AD FS/AD DS, raising alerts. For not-syncing/duplicate issues, check data problems with IdFix first, then filtering/scope settings; isolate error detail via Connect Health and event logs.
Cues: "detect/fix AD format errors/duplicates before sync" = IdFix. "server-resident, advanced filtering/password writeback/complex" = Entra Connect Sync. "lightweight agent, multiple disconnected forests, simple" = Entra Cloud Sync. "monitor sync health/errors and alert" = Entra Connect Health.
Watch the mix-ups: (1) IdFix (pre-sync data fix) vs Connect Health (ongoing monitoring). (2) Connect Sync (resident, complex/writeback) vs Cloud Sync (lightweight, multi-forest/simple) by requirement. (3) Need password writeback → Connect Sync. (4) Do not confuse the monitoring tool (Connect Health) with the sync engine.
2.1.4Section summary
- IdFix detects/fixes on-prem AD format errors/duplicates before sync
- Connect Sync = server-resident, complex/writeback; Cloud Sync = lightweight agent, multi-forest/simple
- Connect Health monitors sync health/errors and alerts
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Before syncing on-prem AD to Microsoft Entra ID, you want to detect and fix issues like invalid UPNs and duplicate proxy addresses. Best?
Q2. You need to sync a complex hybrid setup requiring advanced attribute filtering and password writeback. Best?
Q3. You want to sync multiple disconnected forests to Microsoft Entra ID simply, using lightweight agents. Best?
Q4. You want to continuously monitor directory sync health and get alerts on sync errors. Best?
Q5. Some on-prem users aren’t syncing to Microsoft Entra ID. What is the appropriate first thing to check?