Comparing AD DS and Microsoft Entra ID

Azure Basics · Identity – Microsoft Entra ID (Azure AD), Users and Groups · Lesson 2 of 5

AD DS uses LDAP, Kerberos, OUs and GPOs on the internal network; Entra ID is an identity service for the web, queried over REST and authenticating with SAML, WS-Fed and OpenID Connect.

AD DS (Active Directory Domain Services) is the directory service running on domain controllers in the internal network. Entra ID is not "AD DS in the cloud" but an identity service for the Internet that speaks HTTP/HTTPS.

Aspect	AD DS	Microsoft Entra ID
Queries	LDAP	REST API (Microsoft Graph) over HTTPS
Authentication	Kerberos, NTLM	SAML, WS-Federation, OpenID Connect; authorization with OAuth 2.0
Structure	Domain/forest tree, OUs	Flat: no OUs, no GPOs
Machine management	Group Policy (GPO)	Intune / device policies
External links	Forest trusts	Federation, B2B, external identity providers

flowchart LR
  subgraph OnPrem["On-premises"]
    DC["AD DS<br/>LDAP, Kerberos, OU, GPO"]
  end
  subgraph Cloud["Microsoft cloud"]
    E["Entra ID<br/>REST/Graph, SAML, OIDC, OAuth"]
  end
  DC -- "Entra Connect Sync (hybrid)" --> E
  E --> SaaS["SaaS apps, Azure portal"]

The two often run side by side (hybrid): users created in AD DS are synced to Entra ID to sign in to cloud apps.

Common traps: - Entra ID has no OUs/GPOs and does not answer LDAP queries or issue Kerberos tickets like a domain controller (legacy apps that need that use Entra Domain Services). - OAuth is an authorization protocol (granting API access), not an authentication protocol; OpenID Connect, built on OAuth, handles authentication.

Command	Meaning
`az ad user list --query "[].userPrincipalName" -o tsv`	Query users through Graph (REST)
`az ad user show --id alice@example.com`	Details of one user

Connecting the two worlds

Microsoft offers two sync engines. Entra Connect Sync is a Windows server application installed on-premises; Entra Cloud Sync uses a lightweight agent and keeps its configuration in the cloud, which suits multiple disconnected forests. Both copy users, groups, and attributes from AD DS to Entra ID.

How users then prove their password is a separate choice:

Method	How sign-in works	Trade-off
Password hash sync (PHS)	A hash of the AD password hash is synced; Entra ID checks it	Simplest; sign-in keeps working if on-premises is down
Pass-through authentication (PTA)	Entra ID forwards the check to an agent on-premises	Passwords never leave AD, but agents must stay online
Federation (AD FS)	Sign-in is redirected to an on-premises AD FS farm	Most control and most infrastructure to run

Seamless SSO lets domain-joined PCs on the corporate network sign in to cloud apps without retyping the password.

Other identity services

Microsoft Entra Domain Services provides managed domain controllers in Azure (LDAP, Kerberos, Group Policy) for legacy apps, without you patching servers.
B2B collaboration invites partners as guest users who sign in with their own organisation's account.
Microsoft Entra External ID handles customer sign-up and sign-in for public-facing apps.

Common trap: syncing identities does not move servers or file shares to the cloud; it only lets the same account be used in both places.