Keep trust zones distinct
Tiers, forests, domains, CAs and network segments retain their own boundaries and connector paths.
ENTERPRISE TRUST ARCHITECTURE
Many trust domains. One controlled identity lifecycle.
SYNRION x.ID connects on-premises Active Directory forests through LDAP Connectors and Microsoft Entra ID natively through the Azure Connector to hardware, policies, certification authorities and distributed Outposts.
VALUE IN 30 SECONDS
Scale control without erasing separation.
Connect one identity model
Primary and secondary identities remain accountable across on-premises AD forests, Microsoft Entra ID, administrative roles and separated environments.
Apply policy consistently
Independent approval, hardware evidence and lifecycle rules remain understandable across issuing systems and locations.
CONTROL ACROSS TRUST BOUNDARIES
How does a large identity architecture stay understandable and enforceable?
Enterprise scale is not a larger single-server diagram. It is a deliberate distribution of trust, connector responsibility and hardware protection around one consistent identity lifecycle.
-
01
Map tiers, forests and domains
Identify the administrative boundaries that must remain separate and the primary identities accountable for roles in each one.
-
02
Connect AD DS and Microsoft Entra ID separately
Bring each on-premises forest into the lifecycle through its appropriate LDAP Connector path and address Microsoft Entra ID directly through the native Azure Connector.
-
03
Map internal and public CAs
Connect each certificate use case to its intended certification authority, profile and trust audience.
-
04
Place Outposts by responsibility
Put CA, LDAP and policy functions in the zones where they can perform their task with the smallest necessary access and show the Azure Connector as a separate native cloud path.
-
05
Bind people, hardware and roles
Keep every administrative or operational identity connected to the accountable person and approved security hardware.
-
06
Protect service and CA keys in hardware
Treat machine and service identities as first-class trust objects and use HSM protection for privileged private keys.
-
07
Keep every state change traceable
Issue, renew, revoke, replace and remove identities through a consistent process even when target systems and CAs differ.
THE ARCHITECTURE AT A GLANCE
Keep forests, domains, tiers and CAs separate—coordinate the lifecycle.
TECHNICAL DEPTH
Enterprise scale is controlled distribution.
The following concepts describe different architectural dimensions. Treating them as synonyms hides the decisions that make the environment secure.
- Multi-tier
- Administrative security tiers separate systems and credentials by impact. x.ID can assign distinct secondary identities, hardware and policies to those tiers while retaining the accountable primary identity.
- Multi-forest and multi-domain
- Directory forests and domains define identity and administration boundaries. A least-privileged LDAP Connector can maintain userCertificate and X509:<SKI> in each AD context; Microsoft Entra ID is connected separately and natively through the Azure Connector.
- Microsoft Entra ID and Entra CBA
- The native Azure Connector accesses Microsoft Entra ID directly through Microsoft Graph, without requiring AD synchronization. For Entra CBA it maintains SKI mappings in certificateUserIds. Entra FIDO2 pre-provisioning combines tenant registration with a separate personal PIN handover.
- Multi-CA
- Example: user sign-in through an internal CA, an admin identity through a separate CA and S/MIME through a suitable public provider. x.ID maps each certificate to identity, CA, template or profile and PIV slot. The YubiKey receives certificates, not CA templates; public TLS certificates do not replace a PIV authentication profile.
- Multi-segment
- Network segments restrict technical reach. Outposts connect defined local functions as a star, a chain or a mixed topology over mTLS. Topology follows approved network paths; not every Outpost needs a direct connection to the Core.
- Human and service identities
- People, managed service accounts, applications and infrastructure services have different lifecycle and key-protection requirements but belong in one overall trust model.
- Reports and role-authorized APIs
- Audit reports can be viewed and exported as CSV or Excel. Operational and reporting data is available through the API for authorized roles. Further reports and formats are provided to customer requirements; the shared base also supplies CBOM-capable data.
- Distinguish a report from its exported file
- Reports are not edited afterwards in the Core. Generation runs under the Core’s gMSA; authorized users can retrieve them. The Core provides no additional integrity protection for exported files. Signing by an auditor and secure storage are separate steps.
- Plan retention and recovery
- There is no fixed product-level retention limit; database capacity and customer operations determine available history. One Core with scripted rebuilding is the regular starting point. The customer owns database and required server/HSM key backups; special availability requirements are assessed separately.
EVIDENCE & BOUNDARIES
What should remain provable at enterprise scale.
A large environment is under control when every active identity and key has an accountable owner, intended use, policy, technical location and current lifecycle state.
Identity and role accountability
Secondary identities across tiers, on-premises AD domains and Microsoft Entra ID remain connected to the verified primary identity.
AD and Entra target state
One revocation action combines CA revocation and CRL publication with cleanup of affected certificate entries and mappings in AD/LDAP, the Windows certificate store and Entra CBA.
Reporting in the shared base module
The shared SYNRION base module provides compliance views, CBOM-capable data through APIs and prepared PCI DSS-, DORA- and BSI-oriented reports. Custom reporting and log-data export are possible. This supports assessments; it is not a compliance certification.
Distributed policy enforcement
Outposts and independent policies extend control into separated zones without flattening the architecture.
Hardware-protected privileged keys
User, service and CA key paths can be designed around security keys and supported HSM providers.
RELATED PRODUCT
SYNRION x.ID
Manage YubiKeys, identities, PIV certificates and FIDO2 centrally in a browser. SYNRION x.ID combines native Entra integration with cloud, on-premises or hybrid deployment through Outpost connectors. The portal also supports mobile access; the feature overview states release status and requirements.
THE NEXT CONTROLLED STEP
Bring the real trust boundaries into one architecture view.
We will trace a user identity and a service identity through your CA, directory, Outpost and HSM paths—including renewal, access removal and recovery.