How dfelux/hybrid-identity-lab works
This repository documents a homelab hybrid-identity setup: local AD DS identities synchronize to Microsoft Entra ID using Password Hash Synchronization, where cloud identities are protected and used with cloud apps. It also covers Azure hosting, hybrid join, RBAC, resource governance, setup, and troubleshooting. Relationships follow the README’s architecture diagram and explicit setup notes; no implementation source was provided, so undocumented wiring is omitted.
Main entry points: README.md Setup and troubleshooting
Components 19
Azure hosting
- Azure subscription
- Resource group
- AD VM
- Virtual network
- Network security group
- Public IP
- Tags and locks
On-prem identity
- Domain controller
- AD DS and DNS
- OUs and users
- Entra Connect Sync
- Windows 11 client
- AD groups
Cloud identity
- Entra directory
- Security Defaults MFA
- Azure and cloud apps
- Entra roles
Other components
- Lab administrator
- Setup and troubleshooting
README.md
Connections 18
- Lab administrator → Setup and troubleshooting: follows setup
- Azure subscription → Resource group: contains
- Resource group → AD VM: hosts
- AD VM → Virtual network: uses
- AD VM → Network security group: associated with
- AD VM → Public IP: associated with
- Resource group → Tags and locks: applies
- AD VM → Domain controller: runs
- Domain controller → AD DS and DNS: provides
- AD DS and DNS → OUs and users: organizes
- OUs and users → Entra Connect Sync: synchronizes from
- Entra Connect Sync → Entra directory: syncs hashes to
- Entra directory → Security Defaults MFA: protects sign-in
- Security Defaults MFA → Azure and cloud apps: requires MFA for
- Entra directory → Azure and cloud apps: provides identities to
- AD groups → Setup and troubleshooting: compared in
- Entra roles → Setup and troubleshooting: compared in
- Windows 11 client → Setup and troubleshooting: join troubleshooting