# dfelux/hybrid-identity-lab architecture

> Architecture diagram of the GitHub repository dfelux/hybrid-identity-lab, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/dfelux/hybrid-identity-lab
- Repository: https://github.com/dfelux/hybrid-identity-lab

## Overview

This repository documents a homelab hybrid-identity setup: local AD DS identities synchronize to Microsoft Entra ID using Password Hash Synchronization, where cloud identities are protected and used with cloud apps. It also covers Azure hosting, hybrid join, RBAC, resource governance, setup, and troubleshooting. Relationships follow the README’s architecture diagram and explicit setup notes; no implementation source was provided, so undocumented wiring is omitted.

Main entry points: [`README.md`](https://github.com/dfelux/hybrid-identity-lab/blob/main/README.md) (Setup and troubleshooting)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_hosting["Azure hosting"]
  node_azure["Azure subscription"]
  node_resourcegroup["Resource group"]
  node_vm["AD VM"]
  node_vnet["Virtual network"]
  node_nsg["Network security group"]
  node_publicip["Public IP"]
  node_governance["Tags and locks"]
end

subgraph group_onprem["On-prem identity"]
  node_dc["Domain controller"]
  node_ad[("AD DS and DNS")]
  node_ous["OUs and users"]
  node_connect["Entra Connect Sync"]
  node_client["Windows 11 client"]
  node_localrbac["AD groups"]
end

subgraph group_cloud["Cloud identity"]
  node_entra[("Entra directory")]
  node_security["Security Defaults MFA"]
  node_apps["Azure and cloud apps"]
  node_entrarbac["Entra roles"]
end

node_admin(("Lab administrator"))
node_runbook["Setup and troubleshooting<br/>[README.md]"]

node_admin -->|"follows setup"| node_runbook
node_azure -->|"contains"| node_resourcegroup
node_resourcegroup -->|"hosts"| node_vm
node_vm -->|"uses"| node_vnet
node_vm -->|"associated with"| node_nsg
node_vm -->|"associated with"| node_publicip
node_resourcegroup -->|"applies"| node_governance
node_vm -->|"runs"| node_dc
node_dc -->|"provides"| node_ad
node_ad -->|"organizes"| node_ous
node_ous -->|"synchronizes from"| node_connect
node_connect -->|"syncs hashes to"| node_entra
node_entra -->|"protects sign-in"| node_security
node_security -->|"requires MFA for"| node_apps
node_entra -->|"provides identities to"| node_apps
node_localrbac -->|"compared in"| node_runbook
node_entrarbac -->|"compared in"| node_runbook
node_client -->|"join troubleshooting"| node_runbook

click node_runbook "https://github.com/dfelux/hybrid-identity-lab/blob/main/README.md"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_azure,node_resourcegroup,node_vm,node_vnet,node_nsg,node_publicip,node_governance toneBlue
class node_dc,node_ad,node_ous,node_connect,node_client,node_localrbac toneAmber
class node_entra,node_security,node_apps,node_entrarbac toneMint
class node_admin toneIndigo
class node_runbook toneTeal
```

## Components

### Azure hosting

- **Azure subscription**
- **Resource group**
- **AD VM**
- **Virtual network**
- **Network security group**
- **Public IP**
- **Tags and locks**

### On-prem identity

- **Domain controller**
- **AD DS and DNS**
- **OUs and users**
- **Entra Connect Sync**
- **Windows 11 client**
- **AD groups**

### Cloud identity

- **Entra directory**
- **Security Defaults MFA**
- **Azure and cloud apps**
- **Entra roles**

### Other components

- **Lab administrator**
- [Setup and troubleshooting](https://github.com/dfelux/hybrid-identity-lab/blob/main/README.md): `README.md`

## Connections

- Lab administrator → Setup and troubleshooting: follows setup
- Azure subscription → Resource group: contains
- Resource group → AD VM: hosts
- AD VM → Virtual network: uses
- AD VM → Network security group: associated with
- AD VM → Public IP: associated with
- Resource group → Tags and locks: applies
- AD VM → Domain controller: runs
- Domain controller → AD DS and DNS: provides
- AD DS and DNS → OUs and users: organizes
- OUs and users → Entra Connect Sync: synchronizes from
- Entra Connect Sync → Entra directory: syncs hashes to
- Entra directory → Security Defaults MFA: protects sign-in
- Security Defaults MFA → Azure and cloud apps: requires MFA for
- Entra directory → Azure and cloud apps: provides identities to
- AD groups → Setup and troubleshooting: compared in
- Entra roles → Setup and troubleshooting: compared in
- Windows 11 client → Setup and troubleshooting: join troubleshooting