What is the 365TUNE Hybrid Agent

The 365TUNE Hybrid Agent is a Windows service that lets 365TUNE apply approved changes to user accounts that are mastered in your on-premises Active Directory, without opening any inbound port and without giving 365TUNE a standing account in your forest. This article explains what it is and why it exists. How the 365TUNE Hybrid Agent works covers the architecture, registration and the path of a change, and How the 365TUNE Hybrid Agent is secured covers the controls that protect your directory.

Why an on-premises agent

When your users are synchronised from Active Directory to Microsoft Entra ID, Active Directory remains the source of authority for their identity attributes: names, job title, department, manager, phone numbers, office and address. Microsoft Entra ID shows those values but does not accept changes to them; a write through the Entra admin center or Microsoft Graph fails, and anything that slips through is overwritten at the next synchronisation cycle. The same holds for Exchange attributes such as proxy addresses unless you have moved their management to the cloud.

365TUNE workflows such as joiner, mover and leaver policies therefore need a way to make an approved change where it is mastered. The Hybrid Agent is that way. It runs on a server you control, inside your forest, and applies only the changes you have approved in the 365TUNE portal, only to the organisational units you have authorised, and only to the attributes you have allowed. The next synchronisation cycle then carries the change to Microsoft Entra ID as if an administrator had made it on-premises.

What the agent does

The agent is deliberately narrow:

• It never opens an inbound port. All traffic is outbound HTTPS to 365TUNE.
• It gives 365TUNE no standing account in your forest. It runs as a group managed service account that your own domain controllers manage.
• It acts only within the capabilities, organisational units and attributes configured for it, and only once at least one organisational unit is authorised.
• Every command it receives is signed and time-limited, and every action it takes is written to its audit trail and to the Windows event log.

What it can do is a per-agent selection you make in the portal:

• Modify the attributes on your allow-list, such as names, job title, department, manager, phone numbers and office.
• Enable or disable an account.
• Unlock an account after a lockout.
• Reset a password, optionally requiring a change at next sign-in.
• Add a user to a group, or remove one.
• Create a new user in an authorised organisational unit, disabled or ready to use.

Each selected capability delegates one specific Active Directory right to the agent's service account, scoped to your authorised units, and nothing is selected by default. That list is the whole of it; everything else stays with your own administrators.

Which users the agent handles

Users that are synchronised from Active Directory, whose attributes cannot be changed in the cloud. Users that are cloud-only, or whose source of authority has been moved to Microsoft Entra ID, are managed by 365TUNE directly through Microsoft Graph and never touch the agent.

Where it runs

The agent runs on a Windows server joined to your Active Directory domain, as a Windows service. Use a member server in production; it can run on a domain controller in a lab, but that places a third-party service on one of your most sensitive hosts. The server needs outbound HTTPS only. How to install and set up the 365TUNE Hybrid Agent walks through the installation.

Frequently asked questions

Does 365TUNE get an account in my Active Directory? No. The agent runs as a group managed service account that your own domain controllers manage. Its password is never known to anyone, and its rights are limited to the capabilities, attributes and organisational units you delegate.

Does the agent need a domain controller? No. It can run on a domain controller in a lab, but that places a third-party service on one of your most sensitive hosts, so use a member server in production.

Can I see what the agent did? Yes: every command and its outcome is in the Windows Application event log on the server and in the audit trail in the portal.

Where is the troubleshooting guide? Every message the installer can show, with its cause and fix, is on the page Troubleshooting 365TUNE Hybrid Agent Installation and Registration. The installer links to it from every error it shows.

Read next

• How the 365TUNE Hybrid Agent works: the architecture, installation and registration, how a change reaches Active Directory, and monitoring.
• How the 365TUNE Hybrid Agent is secured: who can register, the credentials, least privilege, what leaves the server, the threat model and a checklist.
• How to install and set up the 365TUNE Hybrid Agent: the step-by-step guide.