# Runbook: Readonly Hybrid Identity Audit

## Goal

Run three read-only audits and merge their outputs into one Executive + Technical report.

## Recommended folder layout

```text
C:\Temp\HybridIdentityAudit
├─ ADDS
├─ EntraConnect
├─ EntraCloud
└─ Merged
```

## Step 0: Prepare PowerShell

```powershell
cd C:\Path\To\readonly-hybrid-identity-audit
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass
Unblock-File .\scripts\*.ps1
```

## Step 1: AD DS audit

Run from a domain management workstation or DC:

```powershell
.\scripts\01-Invoke-ADDSReadonlyAudit.ps1 `
  -OutputPath C:\Temp\HybridIdentityAudit\ADDS `
  -TargetDomainController DC01.contoso.local
```

If event logs are not needed or remote event access is blocked:

```powershell
.\scripts\01-Invoke-ADDSReadonlyAudit.ps1 `
  -OutputPath C:\Temp\HybridIdentityAudit\ADDS `
  -TargetDomainController DC01.contoso.local `
  -SkipEventLogs
```

## Step 2: Entra Connect audit

Run on the Entra Connect Sync server:

```powershell
.\scripts\02-Invoke-EntraConnectReadonlyAudit.ps1 `
  -OutputPath C:\Temp\HybridIdentityAudit\EntraConnect
```

## Step 3: Entra Cloud audit

```powershell
Connect-MgGraph -Scopes "Organization.Read.All","Directory.Read.All","User.Read.All" -NoWelcome

.\scripts\03-Invoke-EntraCloudReadonlyAudit.ps1 `
  -OutputPath C:\Temp\HybridIdentityAudit\EntraCloud
```

## Step 4: Merge report

```powershell
.\scripts\Merge-HybridIdentityReports.ps1 `
  -InputRoot C:\Temp\HybridIdentityAudit `
  -OutputPath C:\Temp\HybridIdentityAudit\Merged `
  -OpenReport
```

## Validation

```powershell
Get-ChildItem C:\Temp\HybridIdentityAudit -Recurse -File |
  Select-Object FullName, Length, LastWriteTime |
  Sort-Object LastWriteTime -Descending
```

Open the newest `.html` file in the `Merged` folder.


## AD DS OU sync scope

The Entra Connect audit script attempts best-effort discovery of AD DS OU/container synchronization scope from local ADSync PowerShell objects. This is read-only. If the environment does not expose OU scope through ADSync PowerShell objects, the report will mark the scope as `Not detected` and recommends verifying OU filtering in the Entra Connect wizard.

To skip this discovery:

```powershell
.\scripts\02-Invoke-EntraConnectReadonlyAudit.ps1 `
  -OutputPath C:\Temp\ReadonlyHybridAudit\EntraConnect `
  -SkipSyncScope
```