Parts 1 and 2 showed how an agent gets a token for a user. This part answers a different question: is the directory entry

for that user the same person the token describes? In a real estate, that check is what a sync engine is trusted to keep true.

We did not want to turn on a real sync, so we built an emulation that is just enough to test the match.

What we were trying to prove

Entra Connect and Cloud Sync need a Windows server, and Microsoft does not support a Samba domain controller as a source. We

had a home tenant that was already hybrid with a stale sync, so we did not touch that sync. We added cloud-created users beside

the existing ones, and we wrote the directory-side data ourselves.

The question was narrow. Given an Active Directory user and the ID token Entra issues for that user, do the identifiers agree?

Four things had to match: the directory identity, the names, the mail address and whether the account is enabled.

Entra will not let us write every field.…