黑料海角91入口

Editor鈥檚 Note: Given the fast-paced nature of technology, it is possible that some of the information presented in this article is out-of-date, or incomplete, in some fashion. The author periodically reviews and revises this article to ensure information contained within is as accurate as possible.

Microsoft^庐 Azure^庐 is an umbrella for a variety of cloud services, including Azure Active Directory (AAD). On its face, Azure AD might seem like a replacement for on-prem Active Directory (AD) or a cloud-based solution for organizations in need of a directory service, but more factors come into play for IT admins making purchasing decisions, including complicated SKUs and licensing. This article examines the total cost of ownership (TCO) of AAD for the type of configuration that a small and medium-sized enterprise (SME) would require for its identity management lifecycle.

AAD was created to extend on-prem AD identities to Azure in order to provide user management for Microsoft Office applications, and now single sign-on (SSO) for service providers (SP). It鈥檚 available as a standalone product, but is also bundled with Microsoft 365 (M365) subscriptions. Microsoft has positioned AAD as the connective tissue within a broader identity and access management (IAM) ecosystem. That extends from users and devices to its security portfolio. Add-ons and integrations are almost inescapable, because AAD is very interwoven with those products. It鈥檚 not even possible to implement Microsoft鈥檚 best practices for AAD without paying more.

A Codependent Approach

Significantly, Microsoft manages endpoints separately from identities even though experts recommend making identity the new perimeter in cybersecurity. Device management (outside of AD) is only bundled with some of its premium M365 SKUs, but not AAD. Organizations that aren鈥檛 using M365 will have to purchase a separate subscription to manage their devices.

Microsoft鈥檚 reference architecture suggests an array of Microsoft-based tools to fully leverage AAD, so even Microsoft-heavy IT shops will encounter more IT infrastructure and maintenance costs. You鈥檒l have limited administrative capabilities if you use AAD without on-prem AD, or aren鈥檛 subscribed to premium tiers and add-on services. For example, you won鈥檛 be able to employ the suite of group policy objects (GPOs) to on-prem Windows devices, and you鈥檒l struggle with authenticating local IT resources such as applications and file servers. 

AAD is also not an open directory, so working with external identities from other identity providers (IP) and connecting users to IT resources (RADIUS, LDAP) requires even more solutions. Some are cloud-based, but others expand its footprint on-premise, and are reliant on AD.

Breaking Up with Active Directory

Don鈥檛 let your directory hold you back. Learn why it鈥檚 time to break up with AD.

Read Now

Costs of Azure Active Directory

To fully assess the TCO of Azure AD, it鈥檚 necessary to account for tangential, but necessary, costs. Fortunately, we鈥檝e developed an equation to help you understand the TCO of AAD:

Costs of Azure Active Directory = Azure AD Premium Package + Add-Ons for device management + External Identities + Azure AD DS + Active Directory + LDAP Server + RADIUS Server + Integration/Management Time for your implements

Let鈥檚 begin by assessing AAD鈥檚 pricing and then branch outward to the other components.

Standalone Azure AD and M365

Standalone AAD has three SKUs:

• AAD Free 鈥� AAD Free provides SSO to Microsoft apps and federation to other SAML/OIDC services. This version is feature-limited with no group management, limited MFA configurations, limits on directory objects per user, and various other restrictions.
• Premium 1 (P1) 鈥� P1 introduces SSO sign-in page customizations, conditional access rules, role-based group assignments to applications, end-user self-service for passwords and MFA, additional cloud security, and options for authenticating users into local Windows apps. 
• Premium 2 (P2) 鈥� P2 adds risk-based identity protection, more self-service capabilities, as well as identity governance and administration and compliance such as privileged access and entitlements management. Logging and reporting is also more comprehensive.

M365 subscriptions also bundle AAD. It鈥檚 not even possible to use M365 without AAD, which serves as its substrate for managing your users. Some admins encounter AAD through Office.

Its directory features are gated off into multiple tiers:

• M365 Business Premium 鈥� This includes device management and security services to protect identities.
• M365 E1 鈥� Device management isn鈥檛 included and AAD is limited.
• M365 E3 鈥� This edition includes device management and AAD P1.
• M365 E5 鈥� This edition includes device management and AAD P2.
• M365 F3 鈥� This edition includes device management and AAD P1.
• Enterprise Mobility + Security (EMS) E3 鈥� This edition includes device management and AAD P1.

EMS E5 鈥� This edition includes device management and AAD P2.

Device Management

AAD sounds a lot like AD, but it doesn鈥檛 perform the same role; for example, it won鈥檛 manage your devices. Microsoft established its Intune product lineup to manage Android/Chrome, Apple, Linux, and Windows endpoints. It uses AAD to manage identities, Configuration Manager (formerly SCCM), in addition to Windows Defender for security and Autopilot for onboarding Windows devices. Intune may be bundled with M365, depending upon your subscription level. However, Intune is not included with AAD P1 or P2, and that omission will increase your monthly costs per user.

Intune includes enterprise-grade features and can be a useful tool for compliance and managing non-Windows devices for organizations that have many remote workers. However, it also has documented downsides. SMEs that are accustomed to AD may be unfamiliar with its quirks:

• Unpredictable time spent importing the provisioning of devices, assigning profiles, and deploying apps.
• Simple mistakes can cause actions to fail, such as a Registry key requirement rule filtering out devices.
• Problems with assigning available licenses to new users.
• Configuration changes taking a long time to go into effect.
• Debugging events and sync logs requiring additional .
• Loss of internet connectivity causing Windows Autopilot to fail.

The cost of learning, implementing, and supporting Intune is another TCO consideration.

Azure Active Directory Domain Services

Intune is not the only option for Microsoft shops. Azure Active Directory Domain Services (Azure AD DS) is billed as a domain controller-as-a-service for virtual machines and legacy applications. It鈥檚 charged for the hour, and the price is based on the number of directory objects.

, 鈥淎zure AD DS provides a managed domain for your users, applications, and services to consume. This approach changes some of the available management tasks you can do, and what privileges you have within the managed domain.鈥�

Azure AD DS differs from on-prem AD in a number of ways, including its lack of domain or enterprise administrator privileges. You also cannot add on-prem domain controllers to the managed domain.

If you use AAD and Azure AD DS in conjunction with on-prem AD 鈥� which is necessary if you want full AD capabilities 鈥� you鈥檒l have to factor in the associated costs for that as well.

Managing External Identities

Microsoft Entra is necessary to manage external (non-Microsoft) identities and devices. There’s a charge for every single MFA authentication for non-Microsoft identities such as Google Workspace. In addition, AAD P1 or P2 licenses are necessary to work with external identities.

Complex Licensing

If you think that AAD is the right solution for your organization, you鈥檒l have to dig through the pricing and SKUs outlined above. It goes without saying that the pricing model is complicated, and non-system access needs may also obligate you to purchase more CALs. You should begin by understanding your current situation. If you have a Microsoft Enterprise Agreement, Open Volume agreement, or are part of the Cloud Solutions Program, you will have a right to certain functionality (Basic and Premium depending upon your specific agreement).

If your IT organization isn鈥檛 a part of any of those programs, yet you鈥檝e purchased Azure or M365, you can purchase the right Premium Azure AD services. It鈥檚 possible for SMEs to overspend on AAD or be upsold by a Microsoft partner due to the complexity of its licensing, so it鈥檚 important to take the time to understand your requirements versus what you鈥檙e paying for.

Complicated Setup and Migrations

The breadth of potential configurations, critical need to understand security best practices, and overall complexity can make adopting AAD a major initiative. Most SMEs aren鈥檛 experts in Microsoft licensing and seek assistance for their implementations. For instance, AAD鈥檚 default settings can place your users at risk of phishing attacks that can even bypass MFA. IT teams that are migrating from products such as AD FS or have multiple domains in a forest will face some technical considerations that may be unclear and unfamiliar. Microsoft鈥檚 states:

鈥淚f you have multiple on-premises domains in a forest, we recommend storing and synchronizing information for the entire forest to a single Azure AD tenant. Filter information for identities that occur in more than one domain, so that each identity appears only once in Azure AD, rather than being duplicated. Duplication can lead to inconsistencies when data is synchronized. For more information, see the Topology section below.鈥� 

That can be significant work for an SME.

The realization that adopting AAD can be very cumbersome has given rise to a , and many organizations purchase blocks of hours to support their deployments. In-house resources may not be enough. Factor implement costs into your TCO calculations.

Cost of Active Directory

Active Directory represents a number of costs for organizations, including servers, software, and licensing. SMEs will also have to maintain a server room, which can add significant costs.

Servers: Domain Controllers

If you use Azure AD with on-prem AD, servers are an obvious cost. You either need to maintain a server room or spin up AD in a virtual environment, both of which must factor into the TCO of Azure AD. You need to budget for the costs of redundant servers, too, in case your primary domain controller (DC) fails. High availability (HA) is automatic whenever there鈥檚 more than one DC. That makes it possible to shut down a server for maintenance without impacting your end users.

Objects are automatically replicated throughout the server cluster and administration is more complex: e.g., add-on apps must be installed and updated on each DC. Adding additional servers to achieve HA may increase licensing, management, and other infrastructure costs.

Software: Windows Server

Beyond the cost of the servers themselves, you鈥檒l need to purchase the software to be installed on them. Since 2016, Windows Server licensing has been on a per , rather than the previous per socketed CPU structure. Admins can purchase those licenses in 2- or 16-packs. You may need to stand up multiple servers for all of the required server roles.

Licensing: Client Access Licenses

Another important cost to consider is client access licenses (CALs), which you purchase based either on user count or device count. Core licensing has become even more expensive.

Hardening AD for Security

It can take more than a work week to secure AD to recommended best practices. Maintaining AD alongside AAD could dramatically increase IT overhead and administrative costs.

Advanced Identity Lifecycle Management

AD isn鈥檛 Zero Trust and identity lifecycle management is a manual process unless SMEs develop automations or use third-party solutions. That increases the risk that users may be over or under-provisioned, or that inactive accounts remain in use. Managing users in AD can be a disjointed, error-prone process. The risk of data exfiltration is higher with manual processes, which creates a financial risk as laws and regulations are treating violations more seriously. AAD鈥檚 advanced identity management policies can extend AD and improve upon it, but only with P1, P2 subscriptions. Azure AD Connect is required to sync identities between AD and AAD.

Server Rooms

An accumulation of hardware, servers, and network equipment means you鈥檒l be spending more for your server room. Eventually, you鈥檒l require a more powerful core switch or better firewall. 鈥淏etter鈥� translates to more expensive and potentially unplanned downtime on your network as well as new annual support costs, change management, and backups of your configurations.

Then, you鈥檒l have to establish physical security controls and ideally, fire suppression. An inert gas system requires sealing a room and having dedicated HVAC. Other solutions for special hazards, including in-rack fire suppression, are also costly. See here for an example:

Microsoft promises consolidation, but its solutions can be a wellspring of added administration.

This next section explores non-systems requirements and challenges AAD creates for SSO.

LDAP Server

AAD and AD lack SSO to everything, especially the core protocols that network devices or Wi-Fi networks use. This can lead to identity silos and duplicate authentication flows. Microsoft promises consolidation, but its solutions can be a wellspring of added administration.

If you aren鈥檛 hosting all your server infrastructure in Azure, you鈥檒l also need to manage the associated identity management costs to manage user access to other cloud infrastructure providers such as AWS^庐 and GCP. Some of these platforms offer their own managed Active Directory services, so you can potentially leverage those managed AD services, but you鈥檒l need to make sure that they can connect back to your other AD infrastructure and/or with Azure. None of this work is easy, and it can add a great deal of fragility to your IAM environment.

Azure AD doesn鈥檛 come with cloud LDAP functionality, so you鈥檒l need to maintain an LDAP server, as well as service on-prem LDAP applications and MFA solution, if required. Azure AD DS is also to sync passwords and group memberships from Active Directory. Azure AD DS allows organizations to migrate legacy applications to Azure entirely, but that service represents an additional cost as well as the work around the migration of applications which is not an easy task in most instances.

RADIUS Server

Azure AD does not come with cloud RADIUS functionality either. Instead, you鈥檒l need to spin up a RADIUS server, use the NPS server role or another cloud service to have the capability of managing Wi-Fi and VPN access. You鈥檒l also require a secondary authentication method. 黑料海角91入口 makes it possible to leverage AAD credentials for delegated authentication. Many network devices use RADIUS for authentication, and the lack of support makes initiatives such as compliances more difficult. Auditors often want devices, down to switches, protected by MFA.

Vendor Lock-In

This level of platform integration may be beneficial for 鈥渁ll Microsoft and Azure鈥� organizations. However, the lack of interoperability through an open directory and continued reliance on AD adds costs, complexity, and administrative overhead. That level of monoculture and high dependence on a single vendor makes it more difficult to adopt 鈥渂est-of-breed鈥� solutions.

With the changing IT landscape, the good news is that IT organizations are leveraging a wider range of platforms. This requires a different set of IT management tools, and specifically, it involves the core identity provider. Using Azure AD encourages the use of Azure throughout your entire environment. AAD, like AD, obligates the use of Microsoft infrastructure and services/applications. This strategy has been successful for Microsoft in the past, and the company is employing it again to work to lock-in customers into Microsoft platforms.

Microsoft鈥檚 promotion of IT consolidation has been successful from a sales perspective, but it doubles down on vendor lock-in. In contrast, an open directory platform provides value lock-in.

Evaluating Azure Active Directory

Azure AD might be the solution for a Microsoft shop that already has AD established and needs to extend their IT resource management to the cloud. However, organizations should assess their existing stack and whether Azure AD will address all their needs before making the purchase. Beyond Azure AD, organizations will likely need to purchase Intune for device management. Azure AD DS is also necessary to maintain Azure AD Connect (along with their on-prem AD instance), as well as RADIUS and LDAP instances and other add-ons. These all represent cost centers. Azure AD is not an all-in-one solution, but does meet certain use cases.

Resource to Calculate TCO

黑料海角91入口 released a TCO Guide and TCO Calculator to help IT admins understand the complete costs of different solutions used in their environment. We also invite you to try for free. It may help extend AD in the way that your organization needs to adapt to change or meet compliance requirements without hassle. 黑料海角91入口 is 

黑料海角91入口鈥檚 open directory platform delivers select features found in AAD, Entra, and Intune with an emphasis on what鈥檚 best for SMEs. Those capabilities are available without gated licensing, tethering your team to legacy systems, or complicated workarounds. It鈥檚 priced to enable workflows, versus charging more for advanced identity lifecycle management. 黑料海角91入口 enables IT unification, as opposed to consolidating with a single vendor.

Its benefits include:

• AAD and AD integration with group syncing
• The ability to import identities from your HR systems at no additional cost
• Attribute-base groups that makes suggested changes and automate memberships
• Mobile Device Management (MDM) and pre-built policies for Apple products, Android (soon), Linux, and Windows endpoints
• SSO to everything, including integrated cloud RADIUS and
• Environment-wide Push MFA and TOTP; certificate-based authentication (soon)
• Optional for privileged access management (PAM)
• Interoperability with , , and
• Integrated, on directory and system activities
• Optional cross-OS patch management and a decentralized password manager

黑料海角91入口 also offers a variety of Professional Services to help ease the load your employees face.

Software renewals come out of the capital expenditures (CAPEX) budget, which is a major long-term expenditure versus operating expenses (OPEX), the day-to-day operational budget. Accounting makes a distinction between software and services. Using services helps your organization to lower its income taxes and free up cash. Services may make it easier to budget when you already know what the ongoing costs will be.