Identity resilience glossary
Hybrid identity
Hybrid identity is an approach that connects on-premises identity systems with cloud identity services so people can use related identities across both environments. It commonly involves provisioning, synchronization, or federation, with different responsibilities for account data and authentication. Active Directory connected to Microsoft Entra ID is one example; the concept also applies to integrations with providers such as Okta.
Why it matters
Hybrid identity lets organizations support cloud applications while retaining on-premises systems. It also creates operational dependencies between directories, connectors, and authentication services. Teams need to know where an identity attribute is managed, how changes reach other systems, and which components must be available for sign-in. The answers depend on the design, not simply the presence of synchronization.
Illustrative identity example
A company maintains employee accounts in Active Directory and connects them to a cloud identity provider. An incorrect department value reaches the cloud through synchronization. Before correcting the cloud record, the team checks which system controls that attribute. Otherwise, a later synchronization could repeat the unwanted value and make a local correction temporary.
Common misunderstanding
Synchronization and authentication are different functions. A cloud directory may receive account updates from an on-premises directory without consulting it for every sign-in. For example, Microsoft Entra password hash synchronization supports cloud password validation, while pass-through authentication depends on reachable on-premises agents and domain controllers. Hybrid identity does not imply one universal sign-in architecture or automatic failover.
Recovery considerations
A recovery plan should cover both the identity records and the connections that keep them usable. Document synchronization direction, attribute ownership, authentication dependencies, and the order in which affected services need attention. Check that a recovered configuration will not be overwritten by a connected system. Testing should include an actual application sign-in, not only confirmation that an account exists in both directories.