Identity is key when planning and implementing a Microsoft 365 environment. While the default identity method within Microsoft 365 is cloud-only, many organizations with reliance on legacy on-premises infrastructure and applications need to plan the deployment of hybrid identities when introducing Microsoft 365 to their organization.

So, what is a hybrid identity? In simple terms, it is the process of providing your users with an identity in the cloud that is based on their on-premises identity. There are several ways in which this can be achieved and they will be explained in detail throughout this chapter.

The basic principles of hybrid identity in Microsoft 365 are shown in the following diagram:

Figure 1.1: Hybrid identity

We will now explain how you can start planning for hybrid identities in Microsoft 365.

You should start by establishing the correct identity type for the business needs of your organization. It is important, at this stage, to recognize who your stakeholders will be in this process, understand their current working tools and practices, and assess how Microsoft 365 could be used best enabling them to work more efficiently and securely.

The following are some examples of your possible stakeholders:

• Users
• Power users
• IT team
• Security team
• Compliance team
• Business owners

Each stakeholder will have their challenges that need to be considered. However, your users account for the highest percentage of your stakeholders. Therefore, your primary focus should be to ensure that the transition to new ways of working is seamless. This is because many users will be nervous about change. How you introduce them to new technologies and working practices is directly related to the success or failure of your project. If your users buy into the changes you are introducing and can realize the benefits, then the rest of your stakeholders are also more likely to follow suit.

While your main users will be focused on doing their job, the remaining stakeholders will have a deeper interest in how a Microsoft 365 hybrid environment meets business requirements. Some of the common business requirements are as follows:

• The modernization of existing IT services and tools
• Providing and securing cloud Software as a Service (SaaS) applications
• Reducing risk by establishing a modern identity-based security perimeter

For addressing these requirements, a logical starting point is to examine how on-premises identities are currently configured. This will give you a better understanding of what you need to plan and implement for identity authentication in the cloud. You need to be aware of any current on-premises synchronization solutions that may be in place, including any third-party solutions. You will also need to consider any existing use of cloud applications in the organization. These will need to be identified and plans made for their continued use, integration, or possible replacement.

Note

Cloud App Discovery using Microsoft Defender for Cloud Apps can be used to analyze existing SaaS app usage within your organization. This will be covered in a later chapter of this book.

Understanding your on-premises identity infrastructure will help you to plan for modernization or digital transformation. So, what is modernization considered to be in the world of information technology? Essentially, it is based on the principle that IT users now wish and expect to be more mobile. They want quick and easy access to their emails, chats, and documents anywhere, anytime, and on any device.

This requirement creates the challenge of how to effectively secure and protect the services within the Microsoft 365 platform while simultaneously ensuring that they are easily available and accessible to users. How is this achieved? It is not possible to wrap a firewall around Microsoft 365 in the traditional sense. Instead, you need to look at the various modern authentication security methods that are available within Azure AD. Let’s discuss these methods in detail in the next section.