As managed service providers we are often asked by the clients whether an on-premises Active Directory or Azure AD is the best option? The decision on this question is not easy to make, because more and more cloud services are also spreading into traditional data center environments.
Even though Active Directory Domain Services (AD DS) and Microsoft Azure Active Directory look very similar, they are not interchangeable and there are a few key differences. Administrators considering a move to Azure Active Directory (Azure AD) for the authentication and authorization, need to understand exactly how the cloud-based platform differs from a traditional on-premises Active Directory (AD). With Azure Active Directory, Microsoft offers a directory service for the cloud. Even though the name is similar to Active Directory, the differences are serious. In this article, we are going to compare Active Directory Domain Services (AD DS) with Azure Active Directory (Azure AD) and examine the most important differences.
- Structural differences between Azure AD and AD DS
A local Active Directory is initially a combination of several services to manage users and systems. These include the Active Directory Domain Services and the Active Directory Federation Services (AD FS). AD DS is the central database that provides all directory services. AD DS is therefore the actual core of an Active Directory.
Microsoft Azure Active Directory cannot create and manage the same domains, trees and forests that AD DS can. Instead, Azure AD treats each organisation as its own tenant, accessing Azure AD through the Azure Portal to manage its employees, passwords and access rights. Companies that opt for one of Microsoft’s cloud services, be it Office 365 or Exchange Online, are tenants or subscribers of Azure AD.
On one hand, Azure Active Directory is a multitenant, cloud-based directory and identity management service from Microsoft. It combines core directory services, application access management, and identity protection into a single solution. Furthermore, Azure Active Directory is designed to support web-based services that use REST API interfaces for Office 365, Salesforce.com, etc. Unlike pure Active Directory, it uses completely different protocols (Goodbye, Kerberos and NTLM) that work with service protocols such as SAML and Oauth 2.0. With Azure AD, single sign-on scenarios can be implemented very easily.
In addition to seamless networking with all Microsoft online services, Azure AD can connect to hundreds of SaaS applications via single sign-on. In this way, employees can access the company’s data without having to log in again and again. The access token is stored locally on the employee’s computer. You can also restrict access by setting up expiry dates for these tokens.
On the other hand, Active Directory focuses on authenticating server services in the data centre. The service was not designed to deal with the challenges of authentication for cloud services. Active Directory does not natively support the connection and management of smartphones and tablets. In most cases, third-party tools are needed here. Azure Active Directory is directly connected to Microsoft Intune and therefore already offers functions for the management and connection of modern devices.
Active Directory focuses on desktop computers and local servers. However, these devices can also become part of Azure AD and benefit from the functions of Microsoft Intune. It’s important to note that only Active Directory offers support for group policies. The group policy function does not exist in Azure AD. There are policies in Azure as well, but they are not compatible with group policies. Companies that rely on Azure AD and Active Directory must therefore build two policy infrastructures that take different approaches and thus support different settings.
- Management tools differ
AAD is managed either in the Azure Portal or with PowerShell. In internal networks, Azure AD will certainly not be ready to replace Active Directory any time soon. In the cloud, Azure AD is better suited in most cases, but not every local server application can be easily moved to the cloud and use Azure AD. For example, it is not possible to extend the schema in Azure AD. Applications that require schema extensions must be installed in Active Directory. Trust positions between domains also do not exist in Azure AD.
Administration in Azure Active Directory is delegated through Role Based Access Control (RBAC). Functions such as Privileged Identity Management (PIM) and Just-in-Time (JIT) are already firmly integrated here. These technologies also exist in ADDS, but must first be set up manually via server services. In most cases, separate servers are even required for this.
- Is it possible to combine Azure AD and Active Directory?
Azure AD and local Active Directory can work together. Microsoft offers the possibility to synchronise local user accounts and group with Azure AD. The necessary tools are provided free of charge. Single sign-on scenarios can also be mapped in this way. If local Active Directory user accounts are required in Microsoft Azure, a domain controller can be operated in Azure that is connected to the local Active Directory. In most cases, companies therefore rely on Active Directory in the local data centre and Azure AD in the cloud. Through synchronisation, user accounts are available everywhere and can be used in a way that makes sense and can be implemented with the respective infrastructure.
- Microsoft AD or Azure AD – what to choose and when?
Microsoft Active Directory and Azure AD are suited to a particular IT environment. So, in which case you can use either solution or a combination of both?
If you have an established on-prem intranet, then Microsoft AD is the best option. You probably have AD installed if the network is large enough and runs Windows Server. As mentioned above, Azure AD is designed for cloud authentication. This makes it the perfect IAM solution for organizations with a large cloud footprint. It also makes sense to consider Azure AD if you plan to move to the cloud. Combination of both solutions ensures seamless authentication between on-prem and cloud resources.
As a conclusion we could say that Microsoft AD or Azure AD is not a matter of choice or preference. It’s more about what best works for your authentication needs. If you need a robust and integrated solution for managing user identities and access to applications and resources, then Azure Active Directory is a powerful tool that is best suited for enterprise-level organizations.