What's changed: Created SC-100 Chapter 3 (Domain 2 second-half: Entra ID/hybrid identity (Entra Connect, PHS/PTA/federation)/external identity (B2B/decentralized); Conditional Access/Entra ID Protection risk/CAE/protected actions/AD DS hardening/Key Vault/managed identity; enterprise access model/PIM/entitlement management/access reviews/CIEM (Entra Permissions Management)/PAW; regulatory compliance (requirements→controls)/Microsoft Purview/Microsoft Priva/Azure Policy/Defender for Cloud regulatory dashboard).
3.1Entra ID and hybrid/external identity
Understand identity design for hybrid/multicloud centered on Microsoft Entra ID, hybrid-identity sync/authentication options, external identities (B2B, decentralized), and identity/network/application controls for access to SaaS/PaaS/IaaS/on-prem.
The previous chapter said "identity is the control plane." This chapter designs that identity foundation. The core is Microsoft Entra ID, placing on-prem AD, other clouds, and even external organizations’ users under consistent access control.
3.1.1Hybrid identity sync and authentication
Sync on-prem AD with Entra ID via Microsoft Entra Connect. Choose an authentication method by requirement: password hash synchronization (PHS: simplest, most resilient, enables leaked-credential detection), pass-through authentication (PTA: validation stays on-prem), or federation (AD FS: when an existing SSO platform or strict control is required). Architects recommend PHS for "keep authenticating even during a cloud outage" and "simplify operations," reserving PTA/federation for special requirements.
3.1.2External identity: B2B and decentralized
For external partners and guests, use Microsoft Entra External ID (B2B collaboration), letting them access with their existing identity (outside your tenant)—you do not manage their passwords. Then govern guest access with Conditional Access and entitlement management. Decentralized identity (verifiable credentials) is a model where users hold/present verifiable credentials themselves, used for specific trust-verification scenarios. Architects choose B2B for "securely invite external people without proliferating accounts."
Cues: "keep authenticating during cloud outage; simplest" = PHS. "keep password validation on-prem" = PTA. "existing AD FS / strict requirements" = federation. "invite external-org people without managing their passwords" = Entra External ID (B2B). "users present verifiable credentials themselves" = decentralized identity.
Watch the mix-ups: (1) PHS syncs a "hash of the hash"—not plaintext passwords. (2) Distinguish B2B (invite external people) from B2C/External ID for customers (consumer-facing). (3) Apply Conditional Access/access reviews to guests too (do not invite and forget).
3.1.3Section summary
- Hybrid identity = sync via Entra Connect; auth = PHS (default/resilient) / PTA (on-prem validation) / federation (AD FS)
- External identity = Entra External ID (B2B) uses their identity to avoid password management; govern with CA/entitlement
- Decentralized identity = users hold/present verifiable credentials for specific use cases
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Which hybrid authentication method keeps authenticating even during a cloud-side outage and is simplest to operate?
Q2. To invite external partners with their existing identity (no password management on your side) and govern via Conditional Access, which is best?
Q3. You have an existing AD FS platform and must meet strict authentication-control requirements. Which hybrid authentication fits?
Q4. Which is true of PHS?
Q5. Which model has users themselves hold and present verifiable credentials?