How the Defender for Identity cloud service and its sensors fit together, what the classic v2.x sensor and the MDE-integrated v3.x sensor collect on domain controllers, AD FS, AD CS and Entra Connect servers, what leaves the server, how the Directory Service Account is used, and how to size, connect and keep sensors healthy.
How Entra Connect Sync and Entra Cloud Sync move AD objects into Entra ID, which one to pick, how PHS, PTA, federation and seamless SSO authenticate hybrid users, the writebacks, Entra Kerberos for WHfB and FIDO2, sync errors and the operational traps.
The three Windows device identity states in Entra ID, what each unlocks for SSO, Conditional Access, Intune, Windows Hello and LAPS, how hybrid join actually registers through the SCP, userCertificate and Entra Connect, why Entra join plus cloud Kerberos trust is now the default answer, and how to verify, clean up and troubleshoot.
The tie-together mental model for this knowledge base, AD DS as the on-prem authority, Entra ID as the cloud authority, the sync bridge between them, device join as the fork that decides GPO or Intune, where each Defender product touches AD, what still needs AD in 2026, and the migration arc most clients are on.