A county keeps on-premises Active Directory while rolling out cloud apps for permitting. Which hybrid architecture consideration should security prioritize?

Hybrid identity architectures that keep on-premises Active Directory while adding cloud permitting apps create a critical trust and connectivity path between directory services and cloud identity providers or application integrations. Security should prioritize securing federation and sync relationships—conditional access, MFA, hardened connectors, certificate and secret management for trusts, monitored sync agents, and tightly controlled network paths from domain controllers or federation servers to cloud endpoints. Compromise or misconfiguration of that bridge often yields broad access across both environments, so hybrid is not "two separate problems"; it is one identity plane with expanded edges.

Assuming hybrid removes the need for MFA because on-prem passwords prove physical presence misunderstands both threats and architecture: remote and cloud access still need strong authentication, and password reuse or phishing can cross the federation boundary. Disabling logging on the sync path to keep replication "private from auditors" destroys detective capability and conflicts with accountability requirements. Treating cloud apps as air-gapped from identity so no directory relationship is required contradicts the operational goal of unified access and usually forces weaker local accounts or unmanaged credentials.

Exam caveat: hybrid questions reward protecting the identity and connectivity bridge, not pretending cloud apps need no directory relationship or that MFA becomes optional. Operationally, inventory every federation/sync trust, restrict which hosts can reach identity connectors, enable detailed sign-in and sync logging, rotate federation secrets on a schedule, and test break-glass and revoke paths when a cloud app or connector is compromised.