Mastering Hybrid Identity: Your SkyCore Azure AD Connect Setup Guide (Microsoft Entra Connect V2)

Step 1: Prepare Your Microsoft Entra Connect Server

Before you even download the installer, it is paramount to prepare your dedicated server. This involves ensuring the operating system is up-to-date, meeting the .NET Framework requirement, and critically, enforcing TLS 1.2 for secure communication. SkyCore Solutions strongly recommends using a clean, dedicated server for Microsoft Entra Connect to minimize potential conflicts and enhance security.

First, verify and enforce TLS 1.2. Although newer OS versions often have it enabled, explicit configuration ensures compliance and security hardening. You can check and set this via PowerShell:

# Check TLS 1.2 status (Optional: May need to install the PSSecurity module if not present)
[Net.ServicePointManager]::SecurityProtocol

# Enforce TLS 1.2 for .NET applications (Required for Entra Connect)
Set-ItemProperty -Path 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319' -Name 'SchUseStrongCrypto' -Value 1 -Type DWord
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319' -Name 'SchUseStrongCrypto' -Value 1 -Type DWord
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' -Name 'Enabled' -Value 1 -Type DWord
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server' -Name 'DisabledByDefault' -Value 0 -Type DWord
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -Name 'Enabled' -Value 1 -Type DWord
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client' -Name 'DisabledByDefault' -Value 0 -Type DWord

• Set-ItemProperty ... -Name 'SchUseStrongCrypto' -Value 1: Configures .NET Framework to use strong cryptography, which includes TLS 1.2.
• Set-ItemProperty ... -Name 'Enabled' -Value 1: Enables the TLS 1.2 protocol for both server and client roles.
• Set-ItemProperty ... -Name 'DisabledByDefault' -Value 0: Ensures TLS 1.2 is not disabled by default.

After executing these commands, a server reboot is recommended to ensure the changes take full effect system-wide. Additionally, verify that .NET Framework 4.7.2 or newer is installed. This is typically included with recent Windows Server updates, but can be manually installed if needed.

Step 2: Download Microsoft Entra Connect V2 Installer

The latest version of the Microsoft Entra Connect Sync installation file (MSI) is exclusively available from the Microsoft Entra admin center. It's crucial to download the most recent version to ensure compatibility, access to the latest features, and to avoid issues with retired versions.

Navigate to the Microsoft Entra admin center and download the installer. There is no direct PowerShell command to download this specific MSI from a public URL as it's typically accessed via the portal.

Portal alternative:

1. Go to entra.microsoft.com.
2. In the left-hand navigation, expand Hybrid management, then select Microsoft Entra Connect.
3. On the Microsoft Entra Connect overview page, locate and click the option to Download Microsoft Entra Connect.
4. Save the AzureADConnect.msi file to a readily accessible location on your dedicated Entra Connect server.

Important Note: As of May 2025, Microsoft announced a mandatory upgrade requirement. All synchronization services in Microsoft Entra Connect Sync will stop working on September 30, 2026, if you are not on at least version 2.5.79.0. SkyCore Solutions strongly advises upgrading to the latest available version well before this deadline to prevent service disruption. Refer to the Microsoft Entra Connect version history for the latest updates.

Step 3: Initiate Express Installation

With the installer downloaded and your server prepared, you can begin the express installation. This method is suitable for single-forest topologies and when you plan to use Password Hash Synchronization for authentication, which is the default and most common choice.

Log in to your dedicated Microsoft Entra Connect server using an account that has Local Administrator permissions. Then, execute the MSI package:

# Navigate to the directory where you saved the installer
cd "C:\Path\To\Installer"

# Execute the installer. The express setup is primarily GUI-driven.
Start-Process -FilePath ".\AzureADConnect.msi" -Wait

• cd "C:\Path\To\Installer": Changes the current directory to where the MSI is located. Adjust the path as needed.
• Start-Process -FilePath ".\AzureADConnect.msi" -Wait: Launches the installer executable. The -Wait parameter ensures the PowerShell session waits for the installer to complete before proceeding, although the subsequent steps are GUI-based.

Follow the on-screen prompts:

GUI Steps for Installation Wizard:

1. On the Welcome page, select the checkbox to agree to the licensing terms, then click Continue.
2. On the Express settings page, click Use express settings. This will configure Password Hash Synchronization and enable automatic upgrades.

The wizard will then proceed to connect to your Microsoft Entra ID tenant.

Step 4: Connect to Microsoft Entra ID

This step establishes the connection between your Microsoft Entra Connect server and your Microsoft Entra ID tenant. You will need to provide the credentials for a Microsoft Entra administrator account.

Within the installation wizard:

GUI Steps for Connecting to Microsoft Entra ID:

1. On the Connect to Microsoft Entra ID page, enter the username and password of your Microsoft Entra Hybrid Identity Administrator account.
2. Click Next.

The wizard will validate these credentials and establish a secure connection to your Microsoft Entra tenant. Ensure the account used has the necessary permissions (Global Administrator or Hybrid Identity Administrator) and that MFA is temporarily disabled for this account during installation.

Step 5: Connect to On-Premises Active Directory DS

Next, you'll provide the credentials for an on-premises Enterprise Administrator account. This account is used by Microsoft Entra Connect to read directory information and perform operations within your Active Directory Domain Services (AD DS).

Within the installation wizard:

GUI Steps for Connecting to AD DS:

1. On the Connect to AD DS page, enter the username and password for an Enterprise Administrator account. You can use either NetBIOS (e.g., FABRIKAM\administrator) or FQDN format (e.g., fabrikam.com\administrator).
2. Click Next.

Microsoft Entra Connect will then create a new service account (MSOL_xxxxxxx) in your on-premises AD, grant it the necessary replication permissions, and store its credentials securely. This service account is what Microsoft Entra Connect uses for its day-to-day synchronization activities.

Step 6: Verify Configured Domains

If you haven't already verified your custom domains in Microsoft Entra ID, the wizard will prompt you to do so. This step is critical because Microsoft Entra Connect can only synchronize users from domains that are recognized and verified in your Microsoft Entra tenant.

Within the installation wizard:

GUI Steps for Domain Verification:

1. If the Microsoft Entra ID sign-in configuration page appears, review each domain marked "Not Added" or "Not Verified."
2. You must go to the Microsoft Entra admin center (or your domain registrar) to verify these domains.
3. Once verified, return to the wizard and click the Refresh icon. Ensure all domains you intend to use are marked as "Added" and "Verified."
4. Click Next.

Proper domain verification ensures that users synchronizing from your on-premises AD will have UPNs (User Principal Names) that correspond to a valid, verified domain in Microsoft Entra ID, allowing for seamless sign-in experiences.

Step 7: Finalize Configuration and Install

This is the final step before installation. Here, you'll confirm your choices and initiate the deployment of Microsoft Entra Connect. You also have an option to enable Exchange Hybrid deployment if you plan to manage mailboxes both on-premises and in the cloud simultaneously.

Within the installation wizard:

GUI Steps for Final Configuration:

1. On the Ready to configure page, you have a few options:
   • Start the synchronization process as soon as configuration completes: This checkbox is selected by default. If you want to perform additional configurations (e.g., filtering specific OUs or attributes) before initial synchronization, clear this checkbox. If cleared, you'll need to manually enable the scheduler later.
   • Enable Exchange Hybrid deployment: Select this if you have Exchange in your on-premises AD and plan to manage mailboxes both on-premises and in Microsoft 365. This ensures the correct synchronization of Exchange attributes.
2. Click Install.

The wizard will now configure and install Microsoft Entra Connect, including the synchronization service, the administration tools, and the necessary agents for Microsoft Entra Connect Health. This process can take several minutes.

# After clicking Install in the GUI, the actual installation process runs.
# If you chose to disable the scheduler:
# To manually enable the scheduler after installation (e.g., after custom configurations):
Set-ADSyncScheduler -SyncCycleEnabled $true

• Set-ADSyncScheduler -SyncCycleEnabled $true: Enables the synchronization scheduler, allowing Microsoft Entra Connect to perform regular delta and full synchronizations.

Upon successful completion, a confirmation screen will appear. Click Exit to close the wizard. SkyCore Solutions recommends immediately signing out and then back into the server before attempting to use the Synchronization Service Manager or Synchronization Rule Editor to ensure all environment variables are correctly loaded.

Step 8: Post-Installation Validation and Monitoring

After installation, it's crucial to validate that Microsoft Entra Connect is functioning as expected. This involves checking the initial synchronization and setting up ongoing monitoring.

To verify synchronization:

Portal and PowerShell Validation:

1. Check synchronization status in Microsoft Entra admin center:
   • Go to entra.microsoft.com.
   • Navigate to Hybrid management > Microsoft Entra Connect.
   • Review the Synchronization Status. You should see successful sync cycles.
   • Check Synchronization Service Manager on the Entra Connect server to review connector operations (C:\Program Files\Microsoft Entra Connect\Synchronization Service\UIShell\miisclient.exe).
2. Verify synchronized objects:
   • In the Microsoft Entra admin center, go to Identity > Users > All users. Look for users synchronized from your on-premises AD. The Source column should show "Windows Server AD."
   • Alternatively, use PowerShell to query a synchronized user:

     Get-MsolUser -UserPrincipalName "user@yourdomain.com" | Format-List DisplayName,UserPrincipalName,ImmutableId,DirSyncEnabled
     

   • Get-MsolUser: Retrieves a user object from Microsoft Entra ID.
   • -UserPrincipalName: Specifies the UPN of the user to retrieve.
   • Format-List DisplayName,UserPrincipalName,ImmutableId,DirSyncEnabled: Displays specific properties, including ImmutableId (the source anchor from on-premises AD) and DirSyncEnabled (indicating synchronization status).

Finally, enable and configure Microsoft Entra Connect Health for robust monitoring of your hybrid identity infrastructure. This service provides alerts, performance monitoring, and usage analytics directly in the Microsoft Entra admin center, ensuring the reliability of your connection.

Portal alternative for Entra Connect Health:

1. After successful installation, the Health Agent is automatically installed.
2. Go to entra.microsoft.com.
3. Navigate to Hybrid management > Microsoft Entra Connect > Microsoft Entra Connect Health.
4. You should see your new Microsoft Entra Connect server reporting its status.

Regularly review the Entra Connect Health dashboard for any synchronization errors, performance issues, or critical alerts to proactively address potential problems.