Determine the user identity model for your organization
Cloud and systems engineer with a strong foundation in networking, automation, and infrastructure design. I write about real-world challenges, best practices, and evolving trends in cloud computing, system administration, and network architecture.
Microsoft 365 supports three main identity models:
Cloud Identities
Synchronized Identities
Federated Identities
Choosing the right model depends on your org’s size, infrastructure, and authentication requirements.
1. Cloud Identities
Definition:
User account exists only in Microsoft Entra ID (formerly Azure AD).
No on-premises Active Directory dependency.
Management:
- Admins create and manage accounts in Microsoft 365 Admin Center.
Characteristics:
Each user has their own username/password stored in Entra ID.
No link to on-prem AD even if names are the same.
Best for:
- Small orgs or startups that don’t need AD DS anymore.
Benefit:
- Simple setup, no sync or federation required.
2. Synchronized Identities
Definition:
User exists in on-premises AD DS and in Microsoft 365.
Accounts are linked and synchronized.
Synchronization tools:
Microsoft Entra Connect Sync
Microsoft Entra Cloud Sync
Management:
On-prem AD DS is authoritative source.
Most changes (like passwords, group memberships) are made on-prem → synced to cloud.
Authentication:
By default → happens in Microsoft 365.
If Pass-Through Authentication (PTA) is enabled → authentication happens directly against on-prem AD DS.
Best for:
- Orgs that already run on-prem AD DS and are moving gradually to the cloud.
Benefit:
- Same Sign-In → users have the same credentials on-prem and in Microsoft 365.
3. Federated Identities
Definition:
- User accounts synchronized from on-prem AD DS, but authentication is delegated to an external IdP (like AD FS).
How it works:
User tries to log into Microsoft 365.
Entra ID redirects request to trusted IdP (e.g., AD FS).
IdP authenticates user (Kerberos, smart card, etc.) and issues a security token.
Microsoft Entra ID validates the token → grants access.
Setup requires:
Trust relationship between Microsoft 365 and IdP.
Exchange of metadata (certificates, endpoints).
Configuration of trust policies.
Authentication dependency:
Relies on on-premises IdP availability (e.g., if AD FS is down, users can’t log in).
Mitigation = deploy AD DS & AD FS in Azure for redundancy.
Best for:
- Large enterprises needing Single Sign-On (SSO) or special authentication methods (e.g., ID card logins).
Benefit:
True SSO → users log into their Windows workstation once, then get access to Microsoft 365 automatically.
Enforces on-prem password/account lockout policies.
4. Comparison Table
| Model | Definition | Best For | Authentication Location | Greatest Benefit |
| Cloud Identity | User only in Microsoft Entra ID | Small orgs, no AD DS | Entra ID (cloud) | Simple to use, no extra tools |
| Synchronized Identity | User in both AD DS & Entra ID (synced) | Orgs with existing AD DS moving to cloud | By default: Entra ID; With PTA: On-prem AD DS | Same Sign-In with one identity source |
| Federated Identity | User in AD DS, auth via IdP (e.g., AD FS) | Large orgs needing SSO, special auth methods | On-prem IdP (redirected from Entra ID) | Single Sign-On + strong on-prem policy control |
5. Key Takeaways for Study
Cloud identity = simplest, only in Microsoft Entra ID → great for small orgs.
Synchronized identity = hybrid model, syncs AD DS with cloud → most common for medium/large orgs.
Federated identity = requires AD FS or external IdP → gives full SSO but more complex.
Entra Connect Sync / Cloud Sync = tools for identity synchronization.
PTA = lets synchronized identities authenticate directly against on-prem AD DS.
SSO benefit → only true with federated identities.
