Sync pain: reliable Azure AD → on‑prem AD user write‑back tool (lightweight .NET)

Executive Summary

Many enterprises that adopt Azure AD still retain on‑prem Active Directory for legacy apps, admin workflows, or regulatory reasons, creating a persistent write‑back need that manifests as orphaned accounts, audit findings, and operational friction; this problem is common across an addressable base of roughly 300,000 enterprises. The incumbent Microsoft toolsets (e.g., Azure AD Connect) are widely used but are heavy, complex to tune for multi‑forest or constrained network environments, and often lack the predictable reliability and observability that security and compliance teams demand. You could build a lightweight .NET agent/service that performs reliable user write‑back from Azure AD to on‑prem AD using Microsoft Graph for change capture, idempotent operations, robust retry/backoff and queuing, minimal‑privilege service accounts, and centralized management with rich audit logs and reconciliation tools. Deliver it as a small Windows service or container with a SaaS control plane; pricing could be in the $2k–$10k ARR range per enterprise tier, and even a 1%–5% share of the 300,000 addressable customers represents meaningful revenue. This is an attractive moment because hybrid IT is sticky, zero‑trust and audit pressure is rising, and Microsoft’s APIs have matured enough to enable a secure, lightweight approach—supporting participation in an $18B identity and directory tooling market. To stand out, prioritize predictable reliability, least‑privilege security, and operational simplicity, while being candid about challenges: earning trust against Microsoft tooling, handling complex multi‑forest topologies, and investing in compliance certifications and enterprise‑grade support will require upfront engineering and sales effort.