> ## Documentation Index
> Fetch the complete documentation index at: https://docs.raidenhq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# RAIDEN hybrid AD onboarding: connect and monitor AD-synced M365 tenants

> Set up RAIDEN for environments where on-premises Active Directory is synced to Microsoft 365 via Azure AD Connect (Entra Connect). Covers prerequisites, monitoring scope, and remediation limitations for AD-synced accounts.

Hybrid AD environments — where on-premises Active Directory is synchronised to Microsoft 365 via Azure AD Connect (Entra Connect) — require a small number of additional setup steps and have specific remediation behaviour. This guide covers what RAIDEN monitors in hybrid environments, how to enable AD sync monitoring, and how to respond to compromised hybrid accounts.

***

## What is a hybrid AD environment?

A hybrid AD environment means:

* Your organisation runs on-premises Active Directory (Windows Server AD)
* User identities are synchronised to Microsoft 365 (Entra ID) using **Azure AD Connect** or **Microsoft Entra Connect**
* Users sign in to M365 services with a UPN that originates in on-prem AD

RAIDEN monitors Microsoft 365 events regardless of whether accounts are cloud-only or AD-synced. The difference affects how **response actions** work when an account is compromised.

***

## Prerequisites

Before connecting RAIDEN in a hybrid environment, confirm the following:

| Requirement                          | Detail                                                                              |
| ------------------------------------ | ----------------------------------------------------------------------------------- |
| **Azure AD Connect / Entra Connect** | Installed, configured, and performing regular sync cycles                           |
| **Global Administrator account**     | Required for initial M365 consent — can be a cloud-only account                     |
| **On-prem AD access**                | You (or your team) can log into a domain controller to disable accounts when needed |
| **Audit logging enabled**            | Enabled in Microsoft Purview — same requirement as cloud-only setups                |
| **RAIDEN account**                   | An active RAIDEN tenant with Owner or Admin access                                  |

<Note>
  RAIDEN does not require a connection to your on-premises Active Directory infrastructure. All monitoring occurs via the M365 audit log and Microsoft Graph APIs. The on-prem AD requirement above is for your incident response team, not for RAIDEN itself.
</Note>

***

## Setup steps

Follow the standard [Quick Start](/getting-started) guide to connect RAIDEN to your M365 tenant. No hybrid-specific consent steps are needed. Once connected, RAIDEN monitors all users — including AD-synced accounts — automatically.

<Steps>
  <Step title="Complete the standard M365 connection">
    Follow [Get started with RAIDEN](/getting-started) to complete the two-step Microsoft consent flow. RAIDEN detects AD-synced accounts automatically from the directory data it reads via `Directory.Read.All`.
  </Step>

  <Step title="Verify AD-synced users appear in RAIDEN">
    After the first poll cycle (5–10 minutes), go to **Settings → Users** (if available) or check the **Cases** view. AD-synced accounts are indistinguishable from cloud-only accounts in RAIDEN's UI — they are monitored identically.

    If you want to confirm a specific account is AD-synced, check the user's profile in the **Microsoft Entra admin centre** under **Users → \[user] → Properties → On-premises sync enabled**.
  </Step>

  <Step title="Review response action settings for hybrid accounts">
    RAIDEN's auto-remediation behaviour differs for AD-synced accounts. Go to **Settings → Response Actions** and review the auto-disable setting:

    * **Cloud-only accounts**: RAIDEN sets `accountEnabled=false` in Entra ID and creates a Conditional Access block policy. The account is fully disabled.
    * **AD-synced accounts**: RAIDEN creates a Conditional Access block policy only. The on-prem AD account is **not automatically disabled** — your team must also disable it in Active Directory Users and Computers (or via PowerShell) to prevent local network access.

    <Warning>
      For AD-synced accounts, a Conditional Access block prevents M365 sign-ins but does not stop the user from authenticating on-premises (e.g., to workstations, file shares, or internal applications). Always disable the account in on-prem AD as well.
    </Warning>
  </Step>

  <Step title="Prepare your hybrid remediation runbook">
    For hybrid environments, create a simple runbook for compromised AD-synced accounts. The typical steps are:

    1. RAIDEN detects a compromise and (if auto-disable is enabled) creates a Conditional Access block
    2. Your analyst reviews the case in RAIDEN and confirms the verdict
    3. Your analyst or IT admin disables the on-prem AD account:
       * **ADUC**: Active Directory Users and Computers → find the user → right-click → Disable Account
       * **PowerShell**: `Disable-ADAccount -Identity <samAccountName>`
    4. Revoke M365 sessions from RAIDEN using the **Revoke Sessions** response action
    5. Reset both the on-prem AD password and any M365 credentials as needed
  </Step>
</Steps>

***

## AD sync monitoring

RAIDEN monitors the following Entra ID events that are particularly relevant in hybrid environments:

| Event type                            | Why it matters in hybrid AD                                                                                              |
| ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| **Directory sync errors**             | Azure AD Connect sync failures can create stale accounts — a risk if a disabled on-prem account stays active in Entra ID |
| **MFA method changes**                | Attackers targeting hybrid accounts often change MFA to maintain access after on-prem password resets                    |
| **Conditional Access policy changes** | Attackers may attempt to remove CA blocks applied during remediation                                                     |
| **Admin role assignments**            | Privilege escalation is more impactful when it extends to hybrid-joined devices and on-prem resources                    |

These are covered by existing RAIDEN detection rules — no additional configuration is needed. See [Detection Coverage](/detection-coverage) for the full rule list.

***

## Limitations in hybrid environments

| Feature                      | Cloud-only              | Hybrid AD-synced                               |
| ---------------------------- | ----------------------- | ---------------------------------------------- |
| Session revocation           | Full                    | Full                                           |
| Conditional Access block     | Full                    | Full                                           |
| Account disable (Entra ID)   | Automatic               | Automatic                                      |
| Account disable (on-prem AD) | N/A                     | **Manual — your team must do this**            |
| Password reset               | Via RAIDEN (if enabled) | Must also reset on-prem AD password separately |

***

## Frequently asked questions

<AccordionGroup>
  <Accordion title="Does RAIDEN need access to my on-premises domain controllers?">
    No. RAIDEN connects only to Microsoft 365 APIs. It does not require network access to your on-premises infrastructure, domain controllers, or VPN.
  </Accordion>

  <Accordion title="Will RAIDEN detect attacks that originate on-prem and then move to M365?">
    RAIDEN detects the M365-side indicators of those attacks — for example, a Pass-the-Hash attack that results in an M365 sign-in from an unusual IP, or a Kerberoasting attempt that leads to suspicious Entra ID authentication. It does not monitor on-prem AD directly.
  </Accordion>

  <Accordion title="What happens if Azure AD Connect sync is delayed or failing?">
    RAIDEN will continue monitoring events for all accounts currently synced to Entra ID. If sync is failing, check the Azure AD Connect health dashboard. RAIDEN does not alert on sync failures — you should monitor those through your existing AD Connect health alerts or Azure Monitor.
  </Accordion>

  <Accordion title="Can I suppress RAIDEN alerts for a specific AD-synced account?">
    Yes. Suppression works identically for cloud-only and AD-synced accounts. From any alert, click **Suppress** and choose to suppress by user, IP, or application. See [Cases & Alerts](/cases-and-alerts#suppression-options).
  </Accordion>

  <Accordion title="We already run an endpoint security product on our on-prem endpoints. How does that interact with RAIDEN?">
    RAIDEN and your endpoint security product monitor different surfaces. RAIDEN covers M365 identity and cloud activity; your endpoint tool covers device-level behaviour. They complement each other. If your endpoint product detects a device-level compromise and the same account shows suspicious M365 activity, RAIDEN will surface the M365-side indicators independently. Cross-correlate findings manually — your endpoint product's threat IDs won't appear in RAIDEN cases.
  </Accordion>
</AccordionGroup>

***

## Getting help

For hybrid AD setup questions, email [support@raidenhq.com](mailto:support@raidenhq.com). Include your tenant slug and a description of your Azure AD Connect version and sync topology.