Skip to main content
Hybrid AD environments — where on-premises Active Directory is synchronised to Microsoft 365 via Azure AD Connect (Entra Connect) — require a small number of additional setup steps and have specific remediation behaviour. This guide covers what RAIDEN monitors in hybrid environments, how to enable AD sync monitoring, and how to respond to compromised hybrid accounts.

​
What is a hybrid AD environment?

A hybrid AD environment means:
  • Your organisation runs on-premises Active Directory (Windows Server AD)
  • User identities are synchronised to Microsoft 365 (Entra ID) using Azure AD Connect or Microsoft Entra Connect
  • Users sign in to M365 services with a UPN that originates in on-prem AD
RAIDEN monitors Microsoft 365 events regardless of whether accounts are cloud-only or AD-synced. The difference affects how response actions work when an account is compromised.

​
Prerequisites

Before connecting RAIDEN in a hybrid environment, confirm the following:
RAIDEN does not require a connection to your on-premises Active Directory infrastructure. All monitoring occurs via the M365 audit log and Microsoft Graph APIs. The on-prem AD requirement above is for your incident response team, not for RAIDEN itself.

​
Setup steps

Follow the standard Quick Start guide to connect RAIDEN to your M365 tenant. No hybrid-specific consent steps are needed. Once connected, RAIDEN monitors all users — including AD-synced accounts — automatically.
1

Complete the standard M365 connection

Follow Get started with RAIDEN to complete the two-step Microsoft consent flow. RAIDEN detects AD-synced accounts automatically from the directory data it reads via Directory.Read.All.
2

Verify AD-synced users appear in RAIDEN

After the first poll cycle (5–10 minutes), go to Settings → Users (if available) or check the Cases view. AD-synced accounts are indistinguishable from cloud-only accounts in RAIDEN’s UI — they are monitored identically.If you want to confirm a specific account is AD-synced, check the user’s profile in the Microsoft Entra admin centre under Users → [user] → Properties → On-premises sync enabled.
3

Review response action settings for hybrid accounts

RAIDEN’s auto-remediation behaviour differs for AD-synced accounts. Go to Settings → Response Actions and review the auto-disable setting:
  • Cloud-only accounts: RAIDEN sets accountEnabled=false in Entra ID and creates a Conditional Access block policy. The account is fully disabled.
  • AD-synced accounts: RAIDEN creates a Conditional Access block policy only. The on-prem AD account is not automatically disabled — your team must also disable it in Active Directory Users and Computers (or via PowerShell) to prevent local network access.
For AD-synced accounts, a Conditional Access block prevents M365 sign-ins but does not stop the user from authenticating on-premises (e.g., to workstations, file shares, or internal applications). Always disable the account in on-prem AD as well.
4

Prepare your hybrid remediation runbook

For hybrid environments, create a simple runbook for compromised AD-synced accounts. The typical steps are:
  1. RAIDEN detects a compromise and (if auto-disable is enabled) creates a Conditional Access block
  2. Your analyst reviews the case in RAIDEN and confirms the verdict
  3. Your analyst or IT admin disables the on-prem AD account:
    • ADUC: Active Directory Users and Computers → find the user → right-click → Disable Account
    • PowerShell: Disable-ADAccount -Identity <samAccountName>
  4. Revoke M365 sessions from RAIDEN using the Revoke Sessions response action
  5. Reset both the on-prem AD password and any M365 credentials as needed

​
AD sync monitoring

RAIDEN monitors the following Entra ID events that are particularly relevant in hybrid environments: These are covered by existing RAIDEN detection rules — no additional configuration is needed. See Detection Coverage for the full rule list.

​
Limitations in hybrid environments

​
Frequently asked questions

No. RAIDEN connects only to Microsoft 365 APIs. It does not require network access to your on-premises infrastructure, domain controllers, or VPN.
RAIDEN detects the M365-side indicators of those attacks — for example, a Pass-the-Hash attack that results in an M365 sign-in from an unusual IP, or a Kerberoasting attempt that leads to suspicious Entra ID authentication. It does not monitor on-prem AD directly.
RAIDEN will continue monitoring events for all accounts currently synced to Entra ID. If sync is failing, check the Azure AD Connect health dashboard. RAIDEN does not alert on sync failures — you should monitor those through your existing AD Connect health alerts or Azure Monitor.
Yes. Suppression works identically for cloud-only and AD-synced accounts. From any alert, click Suppress and choose to suppress by user, IP, or application. See Cases & Alerts.
RAIDEN and your endpoint security product monitor different surfaces. RAIDEN covers M365 identity and cloud activity; your endpoint tool covers device-level behaviour. They complement each other. If your endpoint product detects a device-level compromise and the same account shows suspicious M365 activity, RAIDEN will surface the M365-side indicators independently. Cross-correlate findings manually — your endpoint product’s threat IDs won’t appear in RAIDEN cases.

​
Getting help

For hybrid AD setup questions, email [email protected]. Include your tenant slug and a description of your Azure AD Connect version and sync topology.