Microsoft Entra ID – Installation, Configuration & Management –

Microsoft Entra ID (formerly Azure Active Directory) is Microsoft’s cloud identity and access management service. This KB covers how to stand up a tenant, connect on-premises Active Directory, configure core security controls, and run the service day to day.

Audience: IT administrators, identity engineers, and service desk staff.

Scope: Cloud-only and hybrid (on-prem AD DS + Entra ID) deployments. Out of scope: Entra External ID for customer apps and Entra Domain Services.

Terminology

License tiers

Prerequisites

Confirm every item below before starting installation; hybrid items apply only if you are syncing from on-prem AD DS.

All deployments

• Entra ID tenant exists (created automatically with any Microsoft 365 or Azure subscription).
• Licenses purchased for the tier you need (P1 at minimum for Conditional Access).
• At least two Global Administrator accounts, cloud-only (@<tenant>.onmicrosoft.com), MFA-enabled. One is a break-glass account (see Configuration).
• Access to a public DNS zone for each custom domain you will add.
• Admin workstation with a modern browser; Microsoft Graph PowerShell SDK installed for scripting.

Hybrid (Entra Connect Sync)

• Dedicated, domain-joined Windows Server 2016 or later (2019/2022/2025 recommended), not a domain controller, with full GUI.
• Minimum 4 GB RAM, 70 GB disk, 1.6 GHz CPU for up to 50,000 objects; scale up for larger directories.
• .NET Framework 4.7.2 or later; TLS 1.2 enabled.
• SQL: built-in SQL Server Express LocalDB (up to ~100,000 objects / 10 GB) or full SQL Server for larger estates.
• AD forest functional level 2003 or higher; writable DC reachable.
• Accounts: an Enterprise Admin for installation (used once to create the AD DS connector account) and a Hybrid Identity Administrator or Global Admin in Entra ID.
• Outbound HTTPS (443) to Microsoft 365/Entra endpoints; proxy configured if used.
• UPN suffixes in AD match verified domains in Entra ID (e.g., user@contoso.com, not user@contoso.local).
• Directory cleaned up with IdFix (duplicate proxyAddresses, invalid characters, bad UPNs).

Hybrid (Entra Cloud Sync)

• One or more domain-joined Windows Server 2016+ hosts for the provisioning agent (deploy 3 for high availability).
• gMSA support in the domain (agent uses a group managed service account by default).
• Outbound 443 and 80 to Microsoft endpoints.

Connect Sync vs Cloud Sync: choose Cloud Sync for multiple disconnected forests or lightweight needs. Choose Connect Sync if you need device writeback, pass-through authentication, or complex custom sync rules. Verify current feature parity on Microsoft Learn before deciding.

Installation

Installation has three stages: prepare the tenant, add your domain, then (hybrid only) install a sync engine. Cloud-only organizations stop after stage 2.

Stage 1: Prepare the tenant

1. Sign in to the Microsoft Entra admin center at https://entra.microsoft.com with a Global Administrator account.
2. Go to Identity > Overview > Properties and record the Tenant ID and primary domain.
3. Set the technical contact, privacy contact, and notification email under Properties.
4. Go to Identity > Settings > Company branding and upload sign-in logo, background, and banner text (helps users spot phishing pages).
5. Assign licenses: Identity > Billing > Licenses, or preferably group-based licensing (see Configuration).

Stage 2: Add and verify a custom domain

1. Go to Identity > Settings > Domain names > Add custom domain.
2. Enter the domain (e.g., contoso.com) and select Add domain.
3. Copy the TXT record shown (format MS=msXXXXXXXX) and create it at your DNS host.
4. Wait for DNS propagation (usually minutes, up to 72 hours), then select Verify.
5. Optional: Make primary so new users default to this suffix.
6. If you use Microsoft 365, add the MX, CNAME (autodiscover), and other records the Microsoft 365 admin center lists.

Stage 3a: Install Entra Connect Sync (hybrid)

1. On the prepared server, download the latest Microsoft Entra Connect from the Entra admin center: Identity > Hybrid management > Microsoft Entra Connect > Connect Sync > Download.
2. Run AzureADConnect.msi, accept the license terms.
3. Choose Express Settings (single forest, password hash sync, auto-upgrade) or Customize for anything else.
4. If customizing, choose the sign-in method:
   1. Password Hash Synchronization (PHS) — recommended default; also enables leaked-credential detection.
   2. Pass-through Authentication (PTA) — passwords validated on-prem by agents.
   3. Federation (AD FS) — only if a hard requirement exists; adds infrastructure.
5. Select Enable single sign-on (Seamless SSO) for domain-joined devices if not using Entra-joined devices.
6. Enter Entra ID credentials (Hybrid Identity Administrator or Global Admin).
7. Add the AD forest and enter Enterprise Admin credentials; let the wizard create the AD DS connector account.
8. Confirm the UPN suffix mapping shows Verified for your domain. Use userPrincipalName as the sign-in attribute unless you have a reason not to.
9. Domain/OU filtering: select only OUs containing real users, groups, and devices. Exclude service accounts and admin OUs.
10. Source anchor: leave the default mS-DS-ConsistencyGuid.
11. Optional features: password writeback (needed for SSPR to on-prem), group writeback, device writeback, Exchange hybrid.
12. Tick Start the synchronization process when configuration completes and select Install.
13. Verify: in the Entra admin center, Microsoft Entra Connect should show Sync enabled and a recent last sync time; synced users show On-premises sync enabled: Yes.

Stage 3b: Install Entra Cloud Sync (alternative)

1. In the Entra admin center: Identity > Hybrid management > Microsoft Entra Connect > Cloud sync > Agents > Download on-premises agent.
2. Run AADConnectProvisioningAgentSetup.exe on the agent server and sign in with a Hybrid Identity Administrator.
3. Choose the gMSA option (recommended) and provide domain admin credentials to create it.
4. Confirm the agent shows Active under Agents.
5. Go to Cloud sync > New configuration, select the AD domain, and enable PHS.
6. Set Scoping filters (OUs or groups), review attribute mappings, then Enable the configuration.
7. Repeat steps 1–4 on two more servers for high availability.

Configuration

Configure in this order: emergency access, admin roles, authentication methods, Conditional Access, then users, apps, and devices. Doing security first avoids exposing new accounts with weak protection.

1. Emergency access (break-glass) accounts

1. Create two cloud-only accounts, e.g., bg-admin01@<tenant>.onmicrosoft.com, with permanent Global Administrator.
2. Protect each with a FIDO2 security key or certificate-based authentication; store keys in separate secure locations.
3. Exclude both from every Conditional Access policy.
4. Create an alert (Log Analytics or Sentinel) that fires on any sign-in by these accounts.
5. Test sign-in quarterly and record the result.

2. Administrative roles

• Apply least privilege: use User Administrator, Helpdesk Administrator, Groups Administrator, Application Administrator, etc., instead of Global Admin.
• Keep Global Administrators to fewer than 5 (excluding break-glass).
• Use separate cloud-only admin accounts, never daily-use or synced accounts.
• With P2, make roles eligible in PIM (see step 8) rather than permanently assigned.

3. Authentication methods and MFA

1. Go to Protection > Authentication methods > Policies.
2. Enable Microsoft Authenticator (push with number matching, passwordless phone sign-in), Passkeys (FIDO2), and Temporary Access Pass for onboarding.
3. Disable or limit weak methods: SMS and Voice call only as fallback, if at all.
4. Under Registration campaign, nudge users to register Authenticator.
5. Small tenants without P1: enable Security defaults (Identity > Overview > Properties > Manage security defaults). It forces MFA for all users and blocks legacy auth. Turn it off only when replacing it with Conditional Access.

4. Self-service password reset (SSPR)

1. Protection > Password reset > Properties: enable for Selected (pilot group) then All.
2. Authentication methods: require 2 methods.
3. Registration: require users to register at sign-in; re-confirm every 180 days.
4. On-premises integration: enable password writeback (requires Connect Sync option or Cloud Sync writeback).
5. Enable Password protection with a custom banned-password list (company name, products, locations) and, for hybrid, install the on-prem DC agent.

5. Conditional Access baseline (P1)

Create each policy in Report-only mode, review sign-in impact for 1–2 weeks, then switch to On. Exclude break-glass accounts from all.

Define Named locations (Protection > Conditional Access > Named locations) for office IP ranges and allowed countries before creating CA08.

6. Users and groups

• Cloud-only users: Identity > Users > All users > New user. Set UPN, display name, usage location (required for licensing), and department.
• Synced users: create and edit in on-prem AD; changes flow on the next sync cycle (default every 30 minutes).
• Groups: use Security groups for access and Microsoft 365 groups for collaboration. With P1, create dynamic groups with rules such as (user.department -eq "Finance").
• Group-based licensing: Identity > Billing > Licenses > All products > [product] > Assign to a group.
• Naming policy and expiration: set under Groups > General to control sprawl.
• Guest (B2B) settings: Identity > External Identities > External collaboration settings. Restrict who can invite guests and limit guest directory permissions.

7. Enterprise applications and SSO

1. Identity > Applications > Enterprise applications > New application.
2. Search the gallery for the app (e.g., Salesforce, ServiceNow) or Create your own application.
3. Single sign-on: choose SAML or OIDC. For SAML, enter the Identifier (Entity ID) and Reply URL from the vendor, download the Federation Metadata XML, and upload it to the app.
4. Users and groups: assign groups, not individuals.
5. Provisioning (if supported): set to Automatic with SCIM so accounts are created and removed in the app.
6. Under Enterprise applications > Consent and permissions, set user consent to Allow for verified publishers, selected permissions or disable it, and enable the admin consent workflow.
7. For custom apps, register under App registrations; use certificates rather than client secrets and track expiry dates.

8. Devices

• Device settings (Identity > Devices > Device settings): limit who can join devices to Entra ID; set maximum devices per user (default 50); require MFA to join.
• Entra joined: for cloud-first Windows 10/11 devices, usually via Windows Autopilot and Intune.
• Hybrid Entra joined: for existing domain-joined PCs. Configure in the Connect Sync wizard (Configure device options) or via Cloud Sync plus SCP GPO.
• Entra registered: for personal (BYOD) devices.
• Enable LAPS (Device settings > Enable Microsoft Entra LAPS) to rotate local admin passwords.

9. Privileged Identity Management (P2)

1. Identity governance > Privileged Identity Management > Microsoft Entra roles > Roles.
2. Convert permanent assignments to Eligible for all admins except break-glass.
3. Role settings: activation max 4–8 hours, require MFA and justification, require approval for Global Admin and Privileged Role Admin.
4. Enable notifications to the security team on activation.

10. Logging

1. Identity > Monitoring & health > Diagnostic settings > Add diagnostic setting.
2. Send AuditLogs, SignInLogs, NonInteractiveUserSignInLogs, ServicePrincipalSignInLogs, and RiskyUsers to a Log Analytics workspace (or Sentinel / storage account).
3. Set retention to meet your policy (built-in portal retention is only 7 days on Free, 30 days on P1/P2).

Management

Day-to-day management runs through the Entra admin center for one-off tasks and Microsoft Graph PowerShell for bulk or repeatable work. The legacy AzureAD and MSOnline PowerShell modules are retired; use Microsoft.Graph or the Microsoft.Entra module instead.

Common admin tasks

PowerShell (Microsoft Graph)

Install and connect:

Install-Module Microsoft.Graph -Scope CurrentUser
Connect-MgGraph -Scopes "User.ReadWrite.All","Group.ReadWrite.All","AuditLog.Read.All"

Useful commands:

# Find a user
Get-MgUser -UserId "jdoe@contoso.com" | Select DisplayName,AccountEnabled,OnPremisesSyncEnabled

# List users who haven't signed in for 90 days (requires P1 for sign-in activity)
$cutoff = (Get-Date).AddDays(-90)
Get-MgUser -All -Property DisplayName,UserPrincipalName,SignInActivity |
  Where-Object { $_.SignInActivity.LastSignInDateTime -lt $cutoff } |
  Select DisplayName,UserPrincipalName,@{n='LastSignIn';e={$_.SignInActivity.LastSignInDateTime}}

# Disable an account and revoke sessions
Update-MgUser -UserId "jdoe@contoso.com" -AccountEnabled:$false
Revoke-MgUserSignInSession -UserId "jdoe@contoso.com"

# Add a user to a group
$g = Get-MgGroup -Filter "displayName eq 'Finance Staff'"
New-MgGroupMember -GroupId $g.Id -DirectoryObjectId (Get-MgUser -UserId "jdoe@contoso.com").Id

# List app secrets and certificates expiring within 30 days
Get-MgApplication -All | ForEach-Object {
  $app = $_
  $_.PasswordCredentials + $_.KeyCredentials | Where-Object { $_.EndDateTime -lt (Get-Date).AddDays(30) } |
    Select @{n='App';e={$app.DisplayName}}, EndDateTime
}

Sync management (Entra Connect Sync server)

Import-Module ADSync
Get-ADSyncScheduler                      # check cycle interval and whether sync is enabled
Start-ADSyncSyncCycle -PolicyType Delta  # push recent changes now
Start-ADSyncSyncCycle -PolicyType Initial # full sync after rule or filter changes
Set-ADSyncScheduler -SyncCycleEnabled $false  # pause before maintenance; set $true after

• Use Synchronization Service Manager (miisclient.exe) to view connector run profiles and object errors.
• Keep auto-upgrade enabled, or upgrade manually at least every 6 months; old versions are retired and stop syncing.
• Run a staging-mode server (second Connect Sync server, configured identically, export disabled) for disaster recovery. To fail over, disable staging mode on it and enable staging on the old primary.
• Export the configuration after every change: Connect wizard > View or export current configuration.

Monitoring

• Microsoft Entra Connect Health: install agents for sync (and AD FS/AD DS if used); alerts appear under Identity > Hybrid management > Connect Health.
• Sign-in and audit logs: Identity > Monitoring & health. Query in Log Analytics with KQL for long-term analysis.
• Workbooks: use built-in Conditional Access insights, Sign-ins using legacy authentication, and Authentication methods activity.
• ID Protection (P2): review Risky users and Risky sign-ins daily; confirm compromised or dismiss.
• Secure Score / Recommendations: Identity > Overview > Recommendations lists tenant-specific improvements.

Governance

• Access reviews (P2): Identity governance > Access reviews > New access review. Review guest access and privileged role membership quarterly; auto-apply results to remove denied users.
• Lifecycle workflows: automate joiner (TAP, welcome email), mover, and leaver (disable, remove groups, revoke sessions) tasks based on HR attributes.
• Entitlement management: package groups, apps, and SharePoint sites into access packages with approval and expiry.

Backup and recovery

• Deleted users, Microsoft 365 groups, and app registrations are soft-deleted for 30 days and can be restored.
• Security groups and Conditional Access policies have no recycle bin (deleted CA policies are soft-deleted in recent releases; verify in your tenant). Export CA policies and key settings regularly with Graph PowerShell or a tool such as Microsoft365DSC.
• For synced objects, on-prem AD backups and the AD Recycle Bin remain the source of truth.

Maintenance schedule

Troubleshooting

Start every sign-in investigation in the user’s Sign-in logs: the error code, the Conditional Access tab, and the Authentication details tab usually identify the cause.