Best Practices: AD to Entra ID Migration¶

# Pilot health dashboard query
# Run weekly during pilot phase

# Metric 1: Authentication success rate
$signIns = Get-MgAuditLogSignIn -Filter `
    "createdDateTime ge 2026-07-01 and createdDateTime le 2026-07-14" -All

$pilotGroupId = "pilot-group-object-id"
$pilotMembers = Get-MgGroupMember -GroupId $pilotGroupId -All |
    Select-Object -ExpandProperty Id

$pilotSignIns = $signIns | Where-Object {
    $_.UserId -in $pilotMembers
}

$successRate = ($pilotSignIns | Where-Object { $_.Status.ErrorCode -eq 0 }).Count /
    $pilotSignIns.Count * 100

Write-Host "Pilot auth success rate: $([math]::Round($successRate, 2))%"

# Metric 2: MFA registration completeness
$authMethods = Get-MgReportAuthenticationMethodUserRegistrationDetail -All |
    Where-Object { $_.Id -in $pilotMembers }

$mfaRegistered = ($authMethods | Where-Object { $_.IsMfaRegistered }).Count /
    $authMethods.Count * 100

Write-Host "MFA registration: $([math]::Round($mfaRegistered, 2))%"

# Rollback script: Move user back to AD sync scope
param(
    [string]$UserPrincipalName,
    [string]$OriginalOU
)

# Step 1: Move user back to synced OU in AD
$adUser = Get-ADUser -Filter "UserPrincipalName -eq '$UserPrincipalName'"
Move-ADObject -Identity $adUser.DistinguishedName -TargetPath $OriginalOU

# Step 2: Force sync cycle
# Cloud Sync: automatic within 2 minutes
# Entra Connect: Start-ADSyncSyncCycle -PolicyType Delta

# Step 3: Verify user is re-synced
Start-Sleep -Seconds 180
$mgUser = Get-MgUser -UserId $UserPrincipalName -Property OnPremisesSyncEnabled
Write-Host "Sync re-enabled: $($mgUser.OnPremisesSyncEnabled)"

# Step 4: If device was Entra-joined, re-hybrid-join
# User may need to disconnect from Entra and rejoin domain

# Tools for automated application discovery:

# 1. AD FS relying party audit
Get-AdfsRelyingPartyTrust | Select-Object Name, Identifier, Enabled,
    TokenLifetime, IssuanceTransformRules |
    Export-Csv ".\pass1-adfs-apps.csv" -NoTypeInformation

# 2. LDAP query analysis (enable on DCs for 2 weeks)
# Event ID 2889: unsigned LDAP binds
# Event ID 1644: LDAP search operations (requires diagnostic logging)

# 3. Kerberos ticket analysis
# Event ID 4769: service ticket operations
# Collect for 2+ weeks to capture all services

# 4. Entra ID sign-in logs (for apps already using Entra)
Get-MgAuditLogSignIn -All |
    Group-Object AppDisplayName |
    Sort-Object Count -Descending |
    Select-Object Count, Name |
    Export-Csv ".\pass1-entra-apps.csv" -NoTypeInformation

# 5. Network scanning for LDAP/Kerberos traffic
# Use network monitoring tools to identify undocumented LDAP binds

# GPO audit script
$allGPOs = Get-GPO -All

$audit = $allGPOs | ForEach-Object {
    $gpo = $_
    $report = Get-GPOReport -Guid $gpo.Id -ReportType Xml
    $xml = [xml]$report

    # Count settings
    $computerSettings = ($xml.GPO.Computer.ExtensionData | Measure-Object).Count
    $userSettings = ($xml.GPO.User.ExtensionData | Measure-Object).Count

    # Check if GPO is linked
    $links = $gpo.GpoStatus

    [PSCustomObject]@{
        Name = $gpo.DisplayName
        Id = $gpo.Id
        Status = $gpo.GpoStatus
        Created = $gpo.CreationTime
        Modified = $gpo.ModificationTime
        ComputerSettingCount = $computerSettings
        UserSettingCount = $userSettings
        DaysSinceModified = (New-TimeSpan -Start $gpo.ModificationTime -End (Get-Date)).Days
    }
}

# Identify candidates for retirement
$audit | Where-Object {
    $_.DaysSinceModified -gt 365 -or
    ($_.ComputerSettingCount -eq 0 -and $_.UserSettingCount -eq 0) -or
    $_.Status -eq "AllSettingsDisabled"
} | Format-Table Name, DaysSinceModified, Status -AutoSize

# Export full audit
$audit | Export-Csv ".\gpo-audit.csv" -NoTypeInformation

# Create Entra security groups that map to Fabric roles
$groups = @(
    @{ Name = "CSA-Fabric-Admins";        Role = "Admin" }
    @{ Name = "CSA-Fabric-Contributors";  Role = "Contributor" }
    @{ Name = "CSA-Fabric-Members";       Role = "Member" }
    @{ Name = "CSA-Fabric-Viewers";       Role = "Viewer" }
)

foreach ($group in $groups) {
    New-MgGroup -DisplayName $group.Name `
        -SecurityEnabled $true `
        -MailEnabled $false `
        -MailNickname ($group.Name.ToLower() -replace '-', '') `
        -Description "CSA-in-a-Box Fabric $($group.Role) role"
}

# Configure SCIM provisioning from Entra ID to Databricks
# 1. Register Databricks enterprise application in Entra
# 2. Configure provisioning with Databricks SCIM API endpoint
# 3. Map Entra groups to Databricks groups

# Verify SCIM sync status
$provisioningLogs = Get-MgAuditLogProvisioning -Filter `
    "servicePrincipal/displayName eq 'Azure Databricks'" -Top 20

$provisioningLogs | Select-Object ActivityDateTime, Action,
    @{N="Status"; E={$_.StatusInfo.Status}},
    @{N="User"; E={$_.SourceIdentity.DisplayName}} |
    Format-Table -AutoSize

# Bind Purview roles to Entra security groups
# Purview portal > Data map > Collections > Role assignments

# Recommended role structure:
# Collection: CSA-Platform
#   Data Source Admins:   CSA-Purview-Admins (Entra group)
#   Data Curators:        CSA-Purview-DataStewards (Entra group)
#   Data Readers:         CSA-Purview-DataConsumers (Entra group)
#   Data Share Contributors: CSA-Purview-DataSharers (Entra group)

# Weekly migration health report
function Get-MigrationHealth {
    $report = @{}

    # Sync health
    $syncErrors = (Get-MgAuditLogProvisioning -Filter `
        "statusInfo/status eq 'failure' and activityDateTime ge $(
            (Get-Date).AddDays(-7).ToString('yyyy-MM-ddTHH:mm:ssZ')
        )" -All).Count
    $report["SyncErrors7Days"] = $syncErrors

    # Authentication health
    $authFailures = (Get-MgAuditLogSignIn -Filter `
        "status/errorCode ne 0 and createdDateTime ge $(
            (Get-Date).AddDays(-7).ToString('yyyy-MM-ddTHH:mm:ssZ')
        )" -All).Count
    $report["AuthFailures7Days"] = $authFailures

    # MFA registration
    $mfaStats = Get-MgReportAuthenticationMethodUserRegistrationDetail -All
    $report["MFARegistered"] = ($mfaStats | Where-Object { $_.IsMfaRegistered }).Count
    $report["MFANotRegistered"] = ($mfaStats | Where-Object { -not $_.IsMfaRegistered }).Count
    $report["PasswordlessCapable"] = ($mfaStats |
        Where-Object { $_.IsPasswordlessCapable }).Count

    # Device migration
    $devices = Get-MgDevice -All -Property TrustType
    $report["EntraJoined"] = ($devices | Where-Object { $_.TrustType -eq "AzureAd" }).Count
    $report["HybridJoined"] = ($devices |
        Where-Object { $_.TrustType -eq "ServerAd" }).Count
    $report["Registered"] = ($devices |
        Where-Object { $_.TrustType -eq "Workplace" }).Count

    return $report
}

$health = Get-MigrationHealth
$health | Format-Table @{N="Metric"; E={$_.Key}}, @{N="Value"; E={$_.Value}}