# Architecture

* FSProtect works completely on-premise.
* FSProtect is installed only one Microsoft Windows server, it doesn't require any agent deployment to servers, clients or domain controllers.
* FSProtect works with unprivileged user to scan entire Active Directory.
* In **hybrid environments**, identities are synchronized from **on-premise Active Directory to Microsoft Entra ID (Azure)**.
* Azure/Entra ID integration is **optional** and does not require direct scanning or agent deployment in the cloud.

<figure><img src="/files/QngMhd8xfU6qT8v9QMjP" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.forestall.io/fsprotect/readme/architecture.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.