Anyone running local Active Directory and introducing a cloud service hears the same sentence sooner or later: that needs Entra ID Connect. Often that is true. For email security it does not have to be.
What Entra ID Connect is
Microsoft Entra Connect, called Azure AD Connect until 2023, syncs local Active Directory with Entra ID. It transfers users, groups and contacts, and password hashes if you choose. There is also Entra Cloud Sync, a lighter agent with the same job and fewer features.
Entra Connect runs on a dedicated server with a sync service and a local database. Microsoft classifies this server as highly sensitive, on the same tier as domain controllers.
When you need it
- Microsoft 365 with local identities. If people should sign in to Microsoft 365 with their in-house account, you need the sync.
- Exchange hybrid. Mailboxes in-house and in Exchange Online side by side require a shared directory state.
- Services that read Entra ID only. Many cloud services take people and groups exclusively from Entra ID.
Which rights the sync demands
For password hash sync, the service account needs two replication rights on the domain head: Replicating Directory Changes and Replicating Directory Changes All. The second is the right that allows password data to be read from the directory. Whoever takes over this server effectively owns the domain.
That is no argument against Entra Connect where it is needed. It is an argument against introducing it only because a single service wants to read names and departments.
When local AD is enough
Email security needs fairly little from the directory: who belongs to the organisation, under which addresses, in which groups, with which job title and phone number. There are three paths without Entra ID.
Direct LDAP connection. The service queries the directory itself. That requires access from outside to the domain controller or a published LDAP service. Hardly anyone wants to own that.
File import. An exported list gets uploaded. Simple, but outdated the next day.
Outbound agent. A service on a member server reads the directory and reports outbound. Nothing is open inbound, and incremental sync needs Replicating Directory Changes without the right to password data.
Both side by side
Hybrid operation does not rule out an agent. If people come from Entra ID and from local AD, the service has to merge them, otherwise every person counts twice and gets two licences.
How Conbool solves it
Conbool reads local Active Directory through the directory agent: Kerberos over LDAPS, outbound over HTTPS, a dry run before every write, nested groups fully resolved. Licences, policies, signatures and recipient validation use the same records. Entra ID can be connected in addition.
More on the page email security without Entra ID, the connection is described in the directory documentation.
