SAMPLE-HYBRID-01 · FICTIONAL DATE 2026-01-12
Example Workshop Ltd · Hybrid Identity Review
Status: Fictional format sample · Domain label: example.test (reserved fictional domain; no real organisation) · Method: read-only review of supplied evidence; no live access.
Scope
Directory sync, sign-in method, Seamless SSO and sync scope for one fictional tenant and forest.
Executive summary
Sync is healthy day to day. The main concerns are design choices that remain from an earlier migration: the Seamless SSO Kerberos key has not been rolled over for over 30 days, privileged on-premises accounts are synchronised, and a staged rollout group is still active with no owner.
Evidence reviewed
| ID | Source | Coverage | Status |
|---|---|---|---|
| E-01 | Sync tool configuration screenshots | Scope, rules, enabled features | Provided |
| E-02 | Sync error report | 30 days | Provided |
| E-03 | Authentication method settings | Tenant sign-in method and Seamless SSO | Provided |
| E-04 | UPN suffix and domain list | All suffixes in use | Provided |
| E-05 | Staged rollout configuration | Groups and features | Provided |
What was not checked
- Active Directory health
- Device registration
- Conditional Access policies
- Network and firewall paths to the sync server
Findings
Severity: High means fix first; Medium means plan soon; Low means tidy up.
| ID | Severity | Finding | Evidence | Recommended next step |
|---|---|---|---|---|
| F-01 | Medium | Privileged on-premises accounts are in sync scope | E-01 | Decide whether each privileged account needs a cloud identity; consider separate cloud-only administrator accounts and exclude the rest from sync scope. |
| F-02 | Medium | Seamless SSO Kerberos decryption key not rolled over for more than 30 days | E-03 | Roll the key over using the documented cmdlet, and schedule it at least every 30 days as Microsoft recommends. |
| F-03 | Medium | Staged rollout group still active with no named owner | E-05 | Finish the cut-over for the group and disable staged rollout. |
| F-04 | Medium | 9 users have a UPN suffix that is not verified in the tenant | E-04 | Move them to a verified suffix in a planned batch and tell users about the sign-in name change. |
| F-05 | Low | 2 duplicate proxy address errors unresolved for 60 days | E-02 | Resolve the duplicates and monitor the error report weekly. |
| F-06 | Low | Password writeback enabled with no self-service password reset in use | E-01 | Decide whether to use it; disable it if it is not needed. |
Fix first
- Decide on privileged accounts in sync scope Effort: Medium.
- Roll over the Seamless SSO key and set a schedule Effort: Low.
- Finish and close the staged rollout Effort: Low.
- Fix the 9 unverified UPN suffixes Effort: Medium.
- Resolve duplicate proxy addresses Effort: Low.
30/60/90-day plan
- First 30 days: Fix duplicates; document staged rollout ownership; plan the Seamless SSO key roll-over.
- By 60 days: Remove privileged accounts from sync; roll over the key; finish staged rollout.
- By 90 days: Fix UPN suffixes in batches; review writeback; re-export reports for a follow-up check.
Customer decision
- Approval: this sample authorizes no changes; no remediation was performed.
- Limit: findings reflect only the evidence listed above, as supplied at the time.
Limitations
This fictional sample demonstrates format, not a real assessment. It contains no real customer data, gives no security or compliance guarantee, and made no change to any system.