Tried to glue together three legacy AD forests, an Okta instance, and a GCP directory. Entra ID was the only thing that didn't catch fire. Seriously.
The key is treating it like a gitops target, not a GUI. Everything via Terraform or the Microsoft Graph API. Don't touch the portal unless you enjoy pain. Example of a basic app registration as code:
```hcl
resource "azuread_application" "k8s_dashboard" {
display_name = "k8s-dashboard-prod"
owners = [data.azuread_user.admin.object_id]
web {
redirect_uris = ["https://dashboard.internal.company.com/oauth2/callback"]
}
}
```
Conditional access policies are your new canary deployments. Roll them out to a security group first, watch the logs, then go global. The sync from on-prem is still the wobbliest part—prepare for some chaos engineering.