Azure AD Connect is the primary Microsoft tool for integrating on-premises Active Directory with Azure AD (now Microsoft Entra ID). It facilitates identity synchronization and configures the chosen authentication method, which could be Password Hash Synchronization, Pass-through Authentication, or Federation with AD FS. To use on-premises identities to administer Azure resources, the foundational step is to synchronize them to Azure AD. Azure AD Connect is the tool that accomplishes this. AD FS is only one of several authentication options and is itself often configured through Azure AD Connect, making Azure AD Connect the more fundamental and initial component to implement.

A. No change is needed: AD FS is an optional federation service, not a mandatory first step. The primary tool for establishing hybrid identity is Azure AD Connect.

C. Azure AD join: This process is for registering devices directly with Azure AD. It is unrelated to synchronizing user identities from on-premises AD for resource administration.

D. Enterprise State Roaming: This feature synchronizes user settings and application data across Windows devices. It is not a foundational component for identity management or resource administration.

---

1. Microsoft Learn

Azure Active Directory Documentation. "What is Azure AD Connect?". This document introduces Azure AD Connect as the tool to integrate on-premises directories with Azure AD. It states

"Azure AD Connect is the Microsoft tool designed to meet and accomplish your hybrid identity goals." It lists "Federation integration" as one of its features

showing that AD FS is a component managed by Azure AD Connect

not a prerequisite for it.

Reference: https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/whatis-azure-ad-connect

Introduction section.

2. Microsoft Learn

Azure Active Directory Documentation. "Choose the right authentication method for your Azure Active Directory hybrid identity solution". This document compares the different authentication methods. It presents a flowchart where the decision to use Federation (like AD FS) comes after the initial decision to synchronize with Azure AD

a process managed by Azure AD Connect. This confirms that Azure AD Connect is the starting point.

Reference: https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/choose-ad-authn

"Authentication methods" section and diagram.

3. Microsoft Learn

Azure Active Directory Documentation. "What is federation with Azure AD?". This document explains that federation is an option for authentication and explicitly states

"You can configure federation with AD FS by using Azure AD Connect with only a few clicks." This reinforces that Azure AD Connect is the tool used to implement the solution.

Reference: https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/whatis-fed

"Federation with Azure AD" section.