Overview

Microsoft Entra ID (formerly Azure Active Directory) can be integrated across the Synergetic product suite.

While modern web applications such as SynWeb and the Community Portal natively support cloud-first Single Sign-On via SAML 2.0, legacy client/server applications like SynMain rely on Windows Integrated Authentication (Kerberos/NTLM) or SQL credentials to connect to SQL Server.

To support cloud-managed identities for both web and desktop environments without requiring local on-premises Active Directory domain controllers, schools can implement one of two Microsoft identity bridging architectures: Microsoft Entra Domain Services (Entra DS) or Microsoft Entra Kerberos.

1. Web Applications: SAML 2.0 Integration

For SynWeb and Community Portal, Entra ID operates directly as a standard SAML 2.0 Identity Provider (IdP).

Mechanism: School IT administrators configure Synergetic as an Enterprise Application in the Microsoft Entra admin centre.

Identity Mapping: Entra ID returns a SAML assertion containing a unique identifier (such as the User Principal Name or email address), which maps to the community record via Synergetic SAML configuration settings (MatchField).

Security Controls: Fully compatible with Microsoft Entra Conditional Access policies and Multi-Factor Authentication (MFA).

2. Desktop Client (SynMain): Architecture Options

Because SynMain relies on direct database drivers (ODBC/OLE DB/ADO.NET), passing modern web tokens (OAuth2/SAML) is not natively supported. To facilitate cloud identities, two primary approaches exist for SQL Server authentication:

Option A: Microsoft Entra Domain Services (Entra DS)

Microsoft Entra Domain Services provides a managed, cloud-hosted Active Directory service inside an Azure Virtual Network, eliminating the requirement for dedicated domain controller virtual machines.

How It Works

Entra DS conducts a one-way identity and password hash synchronisation from Entra ID into a managed domain instance, providing native NTLM and Kerberos endpoints in the cloud.

+----------------+        SAML 2.0 (Modern)         +--------------------+
| Entra ID Cloud | -------------------------------> | SynWeb / Portals   |
+----------------+                                  +--------------------+
        |
        | One-way Identity & Hash Sync
        v
+-----------------------------+                     +--------------------+
| Microsoft Entra DS          |   Kerberos / NTLM   | SynMain (Desktop)  |
| (Managed Domain Controller) | <------------------ | & SQL Server VM    |
+-----------------------------+                     +--------------------+

Implementation Highlights

Domain Joining: The SQL Server instance hosting the Synergetic database and any terminal/RDS hosts running SynMain are joined directly to the managed Entra DS domain.

Authentication: SynMain requests a standard Kerberos service ticket from Entra DS for the SQL Server Service Principal Name (SPN). SQL Server accepts the ticket via standard Windows Authentication.

Synergetic Code Impact: Nil. Existing database connection strings and login logic remain unchanged.

Ideal Environment: Schools running their Synergetic database and terminal servers in Azure IaaS or Azure Virtual Desktop (AVD).

Option B: Microsoft Entra Kerberos

Microsoft Entra Kerberos enables Entra ID to issue Kerberos Ticket Granting Tickets (TGTs) directly to Entra-joined Windows devices, removing the need for managed or on-premises domain controllers entirely.

How It Works

Entra ID contains a cloud-hosted Kerberos Key Distribution Centre (KDC). When users sign in to an Entra-joined workstation using cloud credentials, Windows Hello for Business, or FIDO2 keys, Entra ID issues a partial Kerberos TGT alongside standard cloud tokens.

+------------------+   1. Login (Cloud Auth)   +----------------------------+
|                  | ------------------------> | Entra ID-Joined Endpoint   |
|     Microsoft    |   2. Issues Kerberos TGT  | (User running SynMain)     |
|     Entra ID     | <------------------------ +----------------------------+
+------------------+                                         |
        |                                                    | 3. Submits Kerberos
        | 4. Validates SPN / Trust                           |    Service Ticket
        v                                                    v
+---------------------------------------------------------------------------+
| On-Premises or Cloud SQL Server (SQL Server 2022+ or Azure SQL MI)        |
+---------------------------------------------------------------------------+

Implementation Highlights

Endpoint Management: Workstations do not require a traditional Active Directory domain join; devices are managed purely via Microsoft Intune and Entra ID.

Database Compatibility: Requires modern SQL Server deployments (SQL Server 2022 or Azure SQL Managed Instance) configured for Microsoft Entra authentication, or an established hybrid Kerberos trust.

Authentication: SynMain connects using standard Windows Integrated connection strings, with Windows resolving the SQL SPN using the Entra-issued ticket.

Ideal Environment: Schools moving toward a cloud-only endpoint model with modernised database infrastructure.

Technical Comparison Matrix