Managed IT · Identity
How Microsoft Entra ID differs from on-premises Active Directory, what a hybrid setup involves and how to tell whether your office still needs a domain controller.
What each directory does
How hybrid sync works
When the server can go
30 minutes of data collection, your report the next day, yours to keep with no obligation. Or pick a time now. Or call 954-539-5678.
Active Directory (AD DS) is Microsoft’s on-premises directory. It runs on Windows Server domain controllers in your office and handles sign-in to domain-joined PCs, file shares, printers and Group Policy using protocols like Kerberos and LDAP. Microsoft Entra ID, formerly Azure Active Directory, is Microsoft’s cloud identity service. It handles sign-in to Microsoft 365 and other cloud apps using web protocols such as SAML, OpenID Connect and OAuth, and adds multi-factor authentication and Conditional Access.
Microsoft describes Entra ID as an identity-as-a-service solution for apps across cloud and on-premises. Every Microsoft 365 tenant already has Entra ID. Many small businesses run both and sync them. If your apps are in the cloud and you no longer depend on on-premises file servers or legacy software, you can often retire the domain controller and manage devices with Entra join and Intune instead.
AD DS: Windows Server domain controllers you host and patch. Entra ID: a Microsoft cloud service, nothing to host.
AD DS: domain-joined PCs, file shares, printers, on-premises apps. Entra ID: Microsoft 365, SaaS apps and Entra-joined devices.
AD DS: Group Policy over the office network. Entra ID: Intune or another MDM, over the internet from anywhere.
AD DS: password policies and Group Policy. Entra ID: MFA, Conditional Access, sign-in risk and self-service password reset, depending on license.
Neither is a drop-in copy of the other. Entra ID has no Group Policy or organizational units in the AD sense, and it does not replace LDAP for older applications.
Licensing matters too. A basic level of Entra ID comes with Microsoft 365 business subscriptions, but features such as Conditional Access require Entra ID P1, which is included in some plans and sold separately for others. Check what your current licenses include before you plan a migration.
Typical of offices set up a decade or more ago. Sign-in, file shares and printers run through a server in the closet. If you use Microsoft 365 too, users probably have a separate cloud password, which causes confusion and help desk calls.
The most common setup today. Microsoft Entra Connect Sync or the newer Entra Cloud Sync copies users and groups from AD to Entra ID, so staff use one password everywhere. According to Microsoft’s documentation, Cloud Sync uses a lightweight on-premises agent with configuration managed in the cloud, and synchronization runs every two minutes. Devices can be hybrid joined to both directories.
No domain controller. Users exist only in Entra ID, laptops are Entra joined and managed with Intune, and files live in OneDrive, SharePoint or Teams. Microsoft says Entra join suits both cloud-only and hybrid organizations, works with Windows 10 and 11 (except Home editions) and macOS 13 or newer, and supports provisioning through Windows Autopilot.
Use this checklist. If every answer is yes, a cloud-only setup is realistic.
If one or two answers are no, you may still be able to go cloud-first and keep a small footprint for the exceptions. Microsoft Entra Domain Services provides managed domain join, Group Policy, LDAP and Kerberos in Azure for legacy applications, without you running domain controllers.
Not sure whether your office still needs its server? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your IT operations, cybersecurity, applications, integration, automation, AI opportunities, technology spending and business continuity, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.
Expect a small office migration to take weeks rather than days, mostly because of file moves and device resets. Doing it during a planned hardware refresh reduces disruption.
JLB USA manages Microsoft 365 and Google Workspace as part of our managed IT service for businesses with roughly 25 to 100 employees. Our guide to Microsoft 365 security settings covers the Entra ID protections to turn on first, and our cybersecurity services include MFA, access reviews and same-day removal of leavers.
Book it now
Choose a slot that suits you. We’ll confirm by email, collect the data with you on the call, and send your report the next day. It’s free, and the report is yours to keep with no obligation.
Prefer to talk first? Call 954-539-5678, or send the form and we’ll contact you.
Yes. Microsoft renamed Azure Active Directory to Microsoft Entra ID. It is a cloud identity service and is different from on-premises Active Directory Domain Services.
For many small businesses, yes, if their apps are in the cloud and nothing depends on LDAP, Kerberos or domain membership. Legacy applications may need Entra Domain Services or a remaining server.
Only if you keep on-premises Active Directory and want the same accounts and passwords in Microsoft 365. Cloud-only organizations do not need it.
Intune or another mobile device management tool applies settings such as updates, encryption and password rules to Entra-joined devices over the internet.
Yes. Microsoft says Entra-joined devices can still authenticate to on-premises servers, such as file and print, when on the organization’s network and the environment is hybrid.
