Hybrid AD ↔ Entra
Onboarding / Offboarding

The Problem

Onboarding and offboarding a hybrid employee is slow and error-prone because the steps span two identity systems plus mail, device, and delegation surfaces that are easy to miss.

The most common failure is incomplete access removal on offboarding — a disabled account that still holds group memberships, active sessions, MFA methods, shared-mailbox delegates, or third-party OAuth tokens. On the other side, onboarding is inconsistent: the same role gets a different set of groups depending on who typed the commands, and there is no record to prove it happened.

The fix is a deterministic, role-template-driven flow where AD is the source of truth, the deterministic bulk is automated, the judgment calls are explicit human checkpoints, and every step — including every failure — is written to a timestamped audit log.

The Architecture

On-prem Active Directory is the write path. Azure AD Connect syncs changes to Microsoft Entra ID. Microsoft Graph is used read-only to verify state and drive the audit — never as a second write source, so the two systems never disagree.

WRITE   AD account + group membership ──(WinRM, DC)──► on-prem AD
BRIDGE  Azure AD Connect (delta sync) ───────────────► pushes AD → Entra ID
VERIFY  Microsoft Graph (read-only service principal) ► confirm + audit
CONTROL explicit human checkpoints — logged, never auto-approved

Role templates drive assignment. Standard roles (e.g. IT-Engineer) run the full automated flow. Roles that declare elevated access (Domain Admin, jump hosts, financial write) stop at a checkpoint — nothing privileged is auto-assigned.

The Flow — with the Human Checkpoints

flowchart TD
    A[INTAKE<br/>Parse HR PDF] --> B{CHECKPOINT<br/>HR-CONFIRM<br/>HR lead approves summary}
    B --> C[P1: Account Creation<br/>Conflict-check →<br/>Create/reconcile AD account →<br/>Set attributes]
    C --> D[Trigger sync →<br/>Wait for Entra →<br/>License-conflict check]
    D --> E[P2: Access Assignment<br/>Assign role groups<br/>security / functional / mail]
    E --> F[Nested-group resolution]
    F --> G{Role declares<br/>elevated access?}
    G -->|Yes| H{{CHECKPOINT<br/>ELEVATED<br/>Flow stops — nothing<br/>privileged auto-assigned}}
    G -->|No| I[P3: Verify & Notify<br/>Verify AD + Entra →<br/>Notify hiring manager]
    H -.->|manual approval required| I

    classDef checkpoint fill:#ff9f0a,stroke:#ffc266,stroke-width:2px,color:#241804
    classDef process fill:#13233b,stroke:#2997ff,stroke-width:1.4px,color:#ffffff
    classDef decision fill:#2a2008,stroke:#ffb340,stroke-width:1.4px,color:#ffb340

    class B,H checkpoint
    class A,C,D,E,F,I process
    class G decision

flowchart TD
    A[P1: Immediate Containment<br/>Disable account →<br/>Revoke sessions + OAuth →<br/>Reset password →<br/>Revoke MFA] --> B[Trigger sync]
    B --> C{Intune-managed<br/>device found?}
    C -->|Yes| D{{CHECKPOINT: DEVICE<br/>Flag for manual decision<br/>wipe / unenroll / recover}}
    C -->|No| E[P2: Access Cleanup<br/>Remove from ALL groups →<br/>Move to restricted OU]
    D -.-> E
    E --> F[Delegate check<br/>shared mailbox / SharePoint]
    F --> G{{CHECKPOINT<br/>MANAGER-DATA<br/>Mailbox forwarding &<br/>data-archival decisions}}
    G --> H{{CHECKPOINT<br/>DUAL-SIGNOFF<br/>IT + HR sign-off +<br/>legal-hold gate}}
    H --> I[/Final Deletion<br/>NOT executed in demo —<br/>gated, logged as pending/]

    classDef checkpoint fill:#ff9f0a,stroke:#ffc266,stroke-width:2px,color:#241804
    classDef process fill:#13233b,stroke:#2997ff,stroke-width:1.4px,color:#ffffff
    classDef decision fill:#2a2008,stroke:#ffb340,stroke-width:1.4px,color:#ffb340
    classDef notrun fill:#17171a,stroke:#86868b,stroke-width:1.4px,stroke-dasharray:6 5,color:#86868b

    class D,G,H checkpoint
    class A,B,E,F process
    class C decision
    class I notrun

The design principle: automation does the deterministic bulk, humans own the judgment calls — elevated access, data handling, and destructive deletion. Nothing privileged or irreversible is auto-executed.

Results — Measured, Not Claimed

Both flows were run end-to-end against a real hybrid lab (on-prem AD, Azure AD Connect, Microsoft Entra ID) for a test employee, and every number below was read from the timestamped audit of that run.

Where the time actually went

A single known lab defect dominates the wall clock: the AD Connect sync-trigger cmdlet hangs (~90 s per run, finding F4). Stripping that one hung call out, the real automation work is small and fast:

The Findings — Where the Platform Drew the Line

These are the non-obvious, verified-in-lab facts that any team building this automation will hit. Reported honestly — not hidden as errors.

What Was Not Exercised (Stated Explicitly)

• Final account deletion — gated behind IT + HR dual sign-off and a legal-hold check; intentionally not executed in the demo (the safe default). The code path is present.
• Shared-mailbox / SharePoint delegate removal — no Exchange/SharePoint in the lab; the check runs and is logged, but real removal is untestable here.
• Intune device wipe / unenroll — no enrolled devices; the flag-then-decide path is present, but no destructive action was taken (no auto-wipe by default).
• Third-party OAuth revocation — blocked by the 403 scope; not validated end-to-end.
• License-conflict resolution branch — only the "no conflict possible" path was hit (0 SKUs / 0 dynamic groups); the overlap-resolution path is untested.
• Multi-UPN-suffix tenants — only a single-suffix on-prem domain was tested.