We frequently hear this question from companies: 鈥淲e are shifting our business to the cloud and leveraging Microsoft Office 365. Do I need Active Directory (AD) if I have Office 365?鈥�
You don鈥檛 need to continue to leverage Active Directory as you make the move to the cloud. You have the opportunity to reimagine your infrastructure to meet modern IT requirements by:
- Making identity the new perimeter.
- Making devices a secure gateway to resources.
There鈥檚 no obligation to continue using AD if you鈥檙e migrating IT management to the cloud. Cloud migration can be a confusing topic and there have been some big changes in IT. Microsoft鈥檚 identity management plans and licensing can be difficult to understand and are centered around Azure Active Directory (AAD), which is the user management substrate for Office 365 (O365). Microsoft has a wellspring of cloud services that flow from AAD, and the options may not be clear. What is clear is that Microsoft favors cloud-based authentication using its platform.
This article outlines Microsoft鈥檚 way of doing things versus an open directory approach and how IT teams benefit from the freedom to migrate away from O365 or Microsoft, or to select the subscription that works best for them without paying for unnecessary add-ons.
Active Directory and Office 365 Are Evolving
Active Directory is Microsoft鈥檚 on-prem identity management software that has been used for just about two decades now (it was released in early 2000). It dominated as the de facto system to manage Windows庐 machines, and gave Microsoft a strong grip on the market. As a result, Active Directory is the only directory service that many IT admins have experience with.
Microsoft developed AAD in response to a shift to the cloud. This product doesn鈥檛 share the same code base, and is largely meant to serve as a complement to existing on-prem AD implementations. AAD鈥檚 highest cost premium plan extends AD with identity protection and governance and both of its premium tiers integrate cloud identity with legacy Windows apps. Hybrid integrations may meet the requirements of small and medium-sized enterprises (SMEs) that have a need for AD, but it otherwise entwines SMEs more deeply into the Microsoft stack.
It鈥檚 also possible to leave AD behind. AAD鈥檚 not a replacement for AD on its own, but it can serve as a standalone directory when it鈥檚 paired with several SKUs of add-on Azure services or Microsoft 365 plans. However, this migration isn鈥檛 1:1. For instance, groups work differently in AAD. Concepts such as Organizational Units are replaced with Administrative Units in AAD and tenant-wide management. This shift can be difficult and compel SMEs to dedicate significant resources to AAD/AD migrations. Admins often require consultants for this transition.
These are the available AAD plans (note that full AD integrations require Premium plans):
Azure AD鈥檚 (AAD) Tiers
AAD Free Tier
AAD鈥檚 free tier provides single sign-on (SSO) for SaaS applications using your Microsoft identities with multi-factor authentication (MFA).
It offers basic reporting on their substrate identity management solution as well as security and usage reports. It leaves out group assignments, omits custom conditional access rules, and limits how users can be provisioned. It doesn’t provide device management, which leaves admins without device management for endpoint security posture (outside of a hybrid AD configuration). The Free edition won鈥檛 work with Microsoft Sentinel, Azure鈥檚 security information and event management (SIEM) platform.
AAD Premium 1 (P1) Tier
Premium (P1) adds the ability to configure Intune, provisioning for Windows devices, more advanced MFA configurations, conditional access policies, end-user self-service, advanced group management, and more thorough alerts and reporting.
Azure AD Password Protection is also fully enabled versus limited in the Free edition, but it doesn鈥檛 extend to AD. Other features are intended to enable hybrid scenarios for on-premises domain controllers that aren鈥檛 possible with the free edition.
Microsoft obligates its customer to adopt its Edge browser in order for its conditional access policies to work.
AAD Premium 2 (P2) Tier
Premium 2 (P2) includes all of the features of P1 but adds identity governance features including risk-based conditional access policies, conditional access based on device state or location and group, privileged identity protection, Windows Defender for Cloud Apps, and more. Privileged Access Management (PAM) to manage, control, and monitor access administrative roles is only available in this SKU, and only this SKU protects AD against identity compromises.
Security and compliance reporting is more extensive to audit sign-ins, user risk, and abnormal activity. It鈥檚 possible to integrate with SIEMs, perform access certifications and reviews, and investigate risk events. Lifecycle Workflows, a beta lifecycle management service, is also included. P2 is necessary in order to apply identity governance to external directories/identities.
If all of this sounds like too much 鈥渟tuff,鈥� it just may be. P2 is an enterprise-grade solution that could contain more extensive features than an SME requires or has the capacity to implement and use. You could find yourself paying for services that you don鈥檛 need to get the one that you do. The breadth of P2 is significant, and hybrid AD configurations can become expensive.
AAD Can Be a Tollbooth for Google Workspace/Cloud
Suppose you decide to drop MS Office and adopt an alternative such as Google Workspace, but you like using AAD as your directory (maybe it ties back to your old on-prem AD rack). AAD is not all inclusive when it comes to integrating with non-Microsoft identities; Microsoft to manage external identities (with more charges for some authentications). Entra is its solution to apply enterprise-grade to external identities. This means you’ll pay Microsoft a premium if you decide to manage another directory using its AAD/Entra services.
It鈥檚 possible to use AAD for user provisioning and SSO for Google Workspace, but there鈥檚 involved. The AAD ecosystem, by default, tethers SMEs to MS Office. AAD is in effect replicating AD鈥檚 legacy lock-in. Here鈥檚 the for AAD External Identities.
Microsoft permits (for use on its sign-in pages) for the express purpose of setting up guest users to access Microsoft resources such as O365. AAD鈥檚 B2B collaboration places Microsoft apps and resources at the forefront.
Intune Is Required for Device Management
None of the AAD plans include Intune, Microsoft鈥檚 device management service. It鈥檚 only available as an add-on, per user, per month, or bundled with premium Microsoft 365 plans. AD manages Windows devices, but it cannot manage Android, Apple, or Linux based services. Customers have observed such as 8-hour polling for policy refresh internals.聽
If you鈥檙e solely focused on leveraging Azure and don鈥檛 need system management for Linux庐 and macOS庐 systems, cloud servers at AWS庐, Google Workspace integration, or any number of non-Microsoft solutions, then AAD may fit your requirements. However, you鈥檒l pay more in the future if those requirements change. There is no AD equivalent within the Azure ecosystem, as evidenced by the vast expanse of Azure鈥檚 identity, device management, and security services.
Legacy Office 365 Licensing
It鈥檚 important to note that some legacy Office 365 plans , which limits what鈥檚 possible for device management and more.
For instance, Office 365 E3 doesn鈥檛 include an entitlement for Intune and P1. IT admins must change their license, which can be confusing. M365 plans aren’t the same as O365 plans, and the licenses are also different.
Bridging the Gap with an Open Directory Platform
Microsoft isn鈥檛 the only directory option, even with O365. IT stacks have become more heterogeneous with devices and apps from other best-of-breed platforms and vendors. SMEs will have to dedicate significant time and money to migrating AAD to AD, which can also serve as an inflection point to pivot away from being a purely Microsoft shop (while still keeping O365).
That鈥檚 where 黑料海角91入口鈥檚 open directory platform comes in. As a SaaS-based cloud directory service, you don鈥檛 need to have both Active Directory and Azure AD. You can leverage 黑料海角91入口 as your identity provider (IdP) and connect it to Office 365, which integrates with Azure AD. Or, save your budget with the Free tier of AAD and federate identities to 黑料海角91入口.
This connection allows you to provision, deprovision, and sync to Office 365 from 黑料海角91入口, which is ultimately a tight integration with Azure AD. This integration allows you to shift your business completely to the cloud, rather than have one foot in the cloud and another on-prem. Note: 黑料海角91入口 to extend its capabilities if that鈥檚 right for you.
Modern organizations depend on their Workspace and/or O365 implementations 鈥� after all, those solutions are core productivity solutions. The challenge is how to effectively manage those resources, particularly users and what they need to access. Creating users and managing them in Workspace or O365 results in a silo, and you鈥檒l end up constructing a number of 鈥渕ini directories鈥� rather than a centralized identity and access management (IAM) platform.
O365 Without Microsoft Lock-In
Organizations that are considering Office 365 don鈥檛 need AD, and it鈥檚 not necessary to pay for Microsoft鈥檚 Premium subscriptions and add-ons. Rest assured, you can make the move to O365 without being locked into Microsoft鈥檚 ecosystem of Azure subscriptions. 黑料海角91入口 unifies identity, access, and device management capabilities, regardless of the underlying directory, authentication method, or device ecosystem. The platform delivers frictionless access and authenticates users whether they use biometrics, digital certificates, passwords, or SSH keys.
The 黑料海角91入口 platform treats identities as the new perimeter with integrated device management and delivers secure, frictionless access to your resources (even O365 and Google). 黑料海角91入口 also ensures that every resource has a 鈥渂est way鈥� to connect to it.
For example:
- Servers use SSH keys, which are more secure than passwords
- Cloud LDAP with platform-wide MFA
- Passwordless certificates can secure cloud RADIUS Wi-Fi access
- Web applications use SAML and OIDC for authentication
- Optional rules (CA) for privileged access management
- 黑料海角91入口鈥檚 decentralized password manager is an add-on for scenarios where SSO costs too much or isn鈥檛 available
In another departure from Microsoft, 黑料海角91入口鈥檚 pricing is workflow-based, versus SKUs of gated off features that can raise costs. Identities are managed, with devices as the gateway, whether you prefer MS Office or opt to try Google Workspace.
A Secure Identity Lifecycle
In addition, 黑料海角91入口 groups leverage attribute-based access control (ABAC) to automate entitlements. ABAC is a more mature approach to user lifecycle management than AD, which includes manual processes that increase the possibility of mistakes, stale users, or over-provisioning. The platform can either send suggested changes or can be set to become fully automated. AAD defaults to role-based access control, which isn鈥檛 automated, and permissions are assigned. Microsoft only provides its Dynamic Groups for P1 or above.
Device Management Is Included
Fortunately, there鈥檚 no need for additional device management subscriptions such as Intune. 黑料海角91入口 provides standard , cross-OS device management with GPO-like policies (such as full disk encryption), remote assistance, and more. An optional universal patch management subscription keeps operating systems and browsers up to date, in defense against zero day attacks and potential software supply chain risks.
Try 黑料海角91入口鈥檚 Open Directory Platform
Give 黑料海角91入口鈥檚 open directory platform a try for free today by signing up for a free demo. Additionally, if you need some technical information, be sure to check out our or drop a line to one of our product experts.
