Active Directory — choose the right identity service
“Active Directory” can mean three different services. Choose the one whose protocol and operating model match the workload; do not treat the names as interchangeable.
| If you need | Choose | Why |
|---|---|---|
| Cloud sign-in, MFA, Conditional Access, SaaS access, or Azure identity objects | [[entraid | Microsoft Entra ID]] |
| Domain controllers that you install and operate, plus full Windows Server AD control | [[active-directory-domain-services | Active Directory Domain Services (AD DS)]] |
| Domain join, LDAP, Kerberos/NTLM, or Group Policy in Azure without operating domain controllers | [[entra-domain-services | Microsoft Entra Domain Services]] |
Why this distinction matters
Microsoft renamed Azure AD to Microsoft Entra ID. It did not rename Windows Server Active Directory or AD DS. Entra ID is a cloud directory; it does not give every workload the domain-controller, Group Policy, LDAP, or Kerberos/NTLM behavior that an AD DS workload expects.
Northwind example
Northwind’s staff sign in to Azure and Microsoft 365 with Entra ID. Its older warehouse application expects LDAP and Kerberos. Giving a user an Azure role does not add those protocols, so the team evaluates Entra Domain Services or AD DS for that application. The first question is not “which Active Directory name sounds familiar?” but “what identity protocol does the application actually require?”
Plain-language decision
- A modern cloud app that redirects people to a sign-in page usually needs Entra ID.
- A legacy server app that says “domain join,” “LDAP,” “Kerberos,” “NTLM,” or “Group Policy” needs AD DS capabilities.
- Use Entra Domain Services when a managed AD-compatible domain is suitable; use AD DS when the organization needs to operate and customize its own domain controllers.
Related
entraid · active-directory-domain-services · entra-domain-services · service-account · service-principal · managed-identity · rbac
📘 Sources: Microsoft Learn — Azure AD renamed to Microsoft Entra ID and Microsoft Entra Domain Services documentation.