Can I Replace Active Directory with Azure AD (Microsoft Entra ID)?

Can I Replace Active Directory with Azure AD (Microsoft Entra ID)?

Originally published 29 July 2021 · Reviewed 5 November 2026

"Can I replace Active Directory with Azure AD?" is a question we see often, usually from a small organisation that wants to retire its last domain controller. The short answer is: not as a drop-in replacement, but you may be able to retire it eventually, workload by workload. Microsoft renamed Azure Active Directory to Microsoft Entra ID in 2023, so this article uses the new name and keeps "Azure AD" where people still search for it.

What each product is

Active Directory Domain Services (AD DS) is a directory and authentication service that runs on Windows Server domain controllers. It gives you domain join, Kerberos and NTLM authentication, LDAP, Group Policy, organisational units, trusts and a schema you can extend.

Microsoft Entra ID is a cloud identity and access management service. It signs users in to Microsoft 365 and thousands of other applications using modern protocols, protects sign-ins with multifactor authentication and Conditional Access, and gives devices an identity. Microsoft itself says the name change was made partly to reduce confusion with Windows Server Active Directory.

They share an ancestry and some vocabulary, not a feature set. That is why there is no button that migrates a domain into Microsoft Entra ID.

What does not move across

You can synchronise user and group objects from Active Directory to Microsoft Entra ID with Microsoft Entra Connect, but several things in a domain have no direct equivalent in Entra ID:

• Domain controllers and domain authentication. Servers that authenticate users with Kerberos or NTLM need a domain, whether on-premises, on virtual machines or managed.
• Group Policy. Cloud-managed Windows devices use mobile device management such as Microsoft Intune instead, and the settings do not map one to one.
• Computer accounts. A device in Entra ID is a device object, not a domain computer account.
• Organisational unit structure and the schema. Entra ID has its own object model; you do not recreate your OU tree there.

What you can reduce

Plenty of organisations can shrink their reliance on on-premises Active Directory substantially:

• Move line-of-business applications to SAML or OpenID Connect sign-in so they stop needing LDAP binds.
• Manage laptops as Microsoft Entra joined devices with Intune, not as domain-joined machines.
• Move file and print services to cloud or SaaS equivalents where that is acceptable.
• Use Microsoft Entra Domain Services for the few servers that still need domain protocols but do not justify running domain controllers.

A small office with only Microsoft 365, cloud applications and cloud-managed laptops can often run without domain controllers. A site with legacy file servers, on-premises SQL Server using Windows authentication, or software with domain-bound licensing usually cannot yet.

The usual path

1. Inventory dependencies. List which servers, applications and printers authenticate against the domain, and how (Kerberos, NTLM, LDAP).
2. Synchronise identities. Use Microsoft Entra Connect so users have one identity in both places. This is extending the reach of your identities, not replacing the directory.
3. Move what can move. Put applications on modern sign-in and devices under cloud management, one group at a time.
4. Handle the remainder deliberately. Decide whether remaining legacy workloads go to a managed domain, stay on a small self-managed domain, or are retired.
5. Decommission last. Only retire domain controllers after nothing depends on them, and keep backups of the directory until you are sure.

A word on hosting domain controllers in Azure

If the aim is to stop operating hardware, you can run domain controllers on Azure virtual machines and connect them to your on-premises network. That is still self-managed Active Directory, with the same patching and backup responsibilities as before. It is a hosting change, not an identity change, and it is a different decision from moving to Microsoft Entra ID.

Our recommendation

Treat the question as "which dependencies on Active Directory can we remove, and in what order?" instead of "can we switch it off?". Start with an inventory, because that tells you whether the answer is months or years. If you want help scoping that, our hybrid identity checklist lists what to check before you change anything.

Questions to ask your suppliers

Many dependencies hide in software you did not write. Ask each application vendor whether the product supports SAML or OpenID Connect sign-in, whether it can use Microsoft Entra ID without an on-premises domain, and whether it needs a service account or a Kerberos service principal name. Ask your printer and scanner suppliers how scan-to-email and secure print authenticate. Ask your backup supplier which accounts it needs. Written answers turn a vague worry into a dated task list, and they often show that two or three suppliers account for most of the work. Record the answers with the date, because product capabilities change between versions.

Risks to plan for

Removing domain controllers is easy to start and hard to undo. Keep a tested backup of the directory until you are certain nothing needs it. Watch for service accounts that quietly rely on domain authentication, scheduled tasks that run under domain identities, and file shares with permissions based on domain groups. Communicate the change to staff, because users who sign in to a shared computer with a domain account will notice when it changes. Agree a rollback plan before you switch anything off, and keep at least one person who understands the old environment available during the move.

Microsoft references

• New name for Azure Active Directory, including the answer on on-premises Active Directory, reviewed 5 November 2026.
• Compare directory-based services, reviewed 5 November 2026.

This article was first published on 29 July 2021. It was rewritten on 5 November 2026 with current product names and a clearer migration path. Microsoft's live documentation takes precedence if it has changed.