Before mail moves, identity has to be boring. In early 2016 that means Azure AD Connect (or cleaning up a DirSync install that someone stood up as a pilot and forgot). This post is the hybrid identity first mile: UPN hygiene, OU filtering, staging mode, and the mistakes that turn a two-week identity project into a six-month apology tour.
DirSync debt
We still find DirSync boxes under desks. Microsoft’s direction is clear: move to Azure AD Connect. We treat remaining DirSync as a migration of its own — export configuration intent, rebuild properly, do not “upgrade in place and hope.”
UPN and SMTP alignment
Users sign in with UPNs. Office 365 mail wants routable domains. When contoso.local is the UPN suffix, every cloud feature becomes a support call. We:
- Inventory UPN suffixes and conflicts
- Plan alternate login ID only if we must — prefer fixing UPNs
- Align primary SMTP and UPN where business allows
- Communicate password and sign-in changes before cutover
Filtering and what not to sync
Not every service account and every disabled user needs to be in the cloud. OU and attribute filtering keep the directory clean and reduce license accidents. Document why each filter exists; future-you will ask.
Staging mode and dual consoles
Staging mode lets you build a second server and validate before flipping. Use it. Two active sync servers fighting is a classic outage. Write the promotion runbook before you need it at midnight.
Password sync vs federation
Many 2016 estates can start with password hash sync for simplicity. Federation (ADFS) is correct when there are real requirements — smart card, complex access rules, or political SSO mandates. Do not deploy ADFS because a blog from 2013 said it was “enterprise.” We design both; we default to the least machinery that meets the requirement.
Health is a product
Sync errors in the console are not wallpaper. Assign an owner, alert on failure, and review weekly. Identity downtime is mail, SharePoint, and every SaaS app that trusts Azure AD.
Attribute flows and the apps you forgot
Once sync runs, Azure AD becomes the identity source for more than mail. Any mis-mapped proxyAddresses or missing mail attribute becomes a support pile. We validate a sample of executives, shared mailboxes, and dual-permission accounts before declaring sync healthy. Soft-match and hard-match surprises still happen when cloud objects were created out of band during a trial.
Password hash sync operational reality
Hash sync is operationally simple and good enough for many estates in 2016. It is not “less secure than federation” in the cartoon way vendors sometimes imply — but it is different. Document the recovery story: what happens if on-prem AD is unavailable, and which apps truly need seamless SSO versus interactive auth.
ADFS when you truly need it
Smart cards, complex authorization claims, or non-negotiable SSO patterns may force ADFS. Then you own WAP, certificates, and farm patching. Size ADFS as tier-0 infrastructure: redundant nodes, monitored, with certificate expiry alerts that page humans. Federation outages look like “the entire cloud is down.”
Staging server drill
Build staging, import configuration, compare exports, then cut over with a change record. We rehearse the promotion once in a maintenance window even when everyone is “sure.” Certainty without rehearsal is optimism.
Governance of cloud admins
Global Administrator proliferation starts the week the tenant opens. Limit cloud admins early, use separate accounts from daily mail, and write break-glass procedures before Conditional Access complexity arrives in later years.
Scenario walkthrough
Consider a mid-size organization with hybrid identity, mixed desktop delivery, and a mandate to reduce risk without stopping the business. Week one is inventory and sponsor alignment. Week two is a written target state with two options and explicit out-of-scope items. Weeks three and four are pilot build and measurement. Only then does broad change begin. Compressing that sequence into a single weekend is how outages are born.
Along the way, three conversations dominate: who owns identity decisions, who pays for platform capacity, and what residual risk leadership accepts in writing. When those conversations are avoided, engineers improvise under pressure and the organization inherits accidental architecture.
We keep a living risk register with severity, mitigation, residual risk, and owner. The register is reviewed in the same meeting as the delivery burn-down. Risks that never move owners are the ones that become incidents.
If you're facing this
If Office 365 is on the roadmap and UPN suffixes still end in .local, start identity work now. We implement Azure AD Connect and hybrid identity cleanups that migration programs can trust — bring a domain admin and a list of official email domains.