Every zero-AD project meets one application that refuses to leave the directory. Stage 4 is a ladder you work down in order: replace it, re-authenticate it, isolate it, or keep a directory and admit what that costs. Microsoft's own migration guide is missing the rung that actually removes the dependency.
Stage 3 is where the services move. The file server becomes a set of destinations rather than a swap, print and certificates each get a directory-free replacement, and the Wi-Fi runs into the one gap Microsoft never filled. Mostly this article points at the series that already own the details.
There is no supported way to convert a hybrid-joined laptop to Entra join without a reset, and Microsoft says so plainly. Stage 2 stops looking for the shortcut that does not exist and spends its effort making the rebuild cheap: what carries over, what does not, and the one thing you deploy before the first device moves.
The pilot-wave method for the one-way door: transfer a handful of users to cloud-managed, verify, then cut the sync for the tenant and clean up what lingers. Rollback shown where it genuinely exists, and the point of no return named plainly.
Stage 1 is the one-way door. Converting synced users to cloud-managed is now a supported, reversible, per-user operation, which means you can rehearse the irreversible step on three people before you commit a hundred and forty. What changes, what lingers, and the version cliff the sync engine has waiting for you.
Nobody wants to read domain controller logs for a month by hand. Invoke-ADPinCensus turns on the instruments, collects across the window, and hands back one dependency report with the rows pre-populated and the dispositions left to you. What it does, what it deliberately does not, and how to run it.
Turn on the instruments, run them for thirty days, and end Stage 0 with a dependency inventory that has zero unknowns: NTLM and LDAP auditing, the Kerberos consumer census, the account sweep, and the planted test that proves your silence is real.
Every failed AD migration starts with a dependency list built from memory. The domain controllers have been keeping their own inventory for years. Stage 0 is learning to read it: what can pin a domain, the instrument for each class, and the gate that ends the guessing.
