Directory services in Azure: Microsoft Entra ID and Microsoft Entra Domain Services

Slide 1 / 13

Directory services in Azure: Microsoft Entra ID and Microsoft Entra Domain Services

Introduction to Azure directory services: Microsoft Entra ID and Microsoft Entra Domain Services for identity and access management.

Directory services: the quick idea

A directory service helps systems recognize identities and control access. Stores users, groups, and attributes. Supports sign-in and access decisions. Two common Azure options: Entra ID, Entra Domain Services.

Authentication vs Authorization

Identity is two steps: prove who you are, then decide what you can do. Authentication equals 'Who are you?'. Authorization equals 'What can you access?'. Directories help with both (in different ways).

Microsoft Entra ID (cloud IAM)

Entra ID is a cloud Identity and Access Management (IAM) service for app sign-in and access. Formerly Azure Active Directory (Azure AD). Manages users, groups, and app registrations. Enables Single Sign-On (SSO) to cloud apps. Designed for cloud identity (not a Windows domain).

Access rules in Entra ID

Conditional Access controls sign-in by applying rules like requiring Multifactor Authentication (MFA). Conditional Access equals sign-in policy engine. Multifactor Authentication (MFA) adds a second check. You must configure policies and roles. 'Managed identity' does not mean 'automatic security'.

Active Directory Domain Services (AD DS)

AD DS is the traditional Windows domain model backed by domain controllers (DCs). Domain join and Group Policy. Lightweight Directory Access Protocol (LDAP). Kerberos authentication. NT LAN Manager (NTLM) authentication.

Microsoft Entra Domain Services (managed domain)

Entra Domain Services provides managed AD DS-style features in Azure without managing domain controllers. Formerly Azure AD Domain Services (Azure AD DS). Domain join, Group Policy, LDAP, Kerberos/NTLM. Microsoft manages and patches the domain controllers. One-way sync from Entra ID into the managed domain.

Quick decision rule

Choose based on what the workload expects: cloud sign-in vs domain features. Cloud apps plus SSO → Microsoft Entra ID. Domain join/LDAP/Kerberos/NTLM → Entra Domain Services. Don't pick based only on 'where it runs'. Entra ID does not equal AD DS.

Scenario: SSO to SaaS apps

Single Sign-On (SSO) to Software as a Service (SaaS) apps points to Entra ID. Users sign in once for many cloud apps. Central user/group management in the cloud. Entra ID provides SSO and authentication. Not a domain controller scenario.

Scenario: legacy domain requirements

Domain join and classic protocols (LDAP/Kerberos/NTLM) point to Entra Domain Services. App expects domain join and Group Policy. Needs Lightweight Directory Access Protocol (LDAP). Uses Kerberos or NT LAN Manager (NTLM). Use Entra Domain Services for managed domain features.

Scenario: cloud apps + domain workloads

Entra ID and Entra Domain Services can work together when you have mixed needs. Entra ID: cloud identities plus SSO for apps. Entra Domain Services: domain features for some workloads. Use both when requirements are split. No single service replaces everything.

Managed doesn't mean automatic

You still configure access policies and admin permissions in Entra services. Set Conditional Access policies (Entra ID). Assign admin roles and permissions (Entra ID). Control who administers the managed domain (Domain Services). Managed equals less patching, not less responsibility.

Pitfalls to avoid

Choose by what the workload expects, and remember you still configure policies and permissions. Don't confuse Entra ID with AD DS. Entra ID is not a domain controller. Domain Services is managed AD DS-style, not full control.