Directory service

Identity and management solution

Authentication and authorization solution

Built into Microsoft Azure

Microsoft implementation of IaaS

Centralized and secure

Identity store

Authenticate user

Cloud resources

Multi-factor authentication

Single sign-on

Active Directory

Azure AD Premium

Azure AD Basic

Querying

Enterprise features

Decoupling of server

Azure AD Admin Center

Azure AD Join

Azure AD Domain Services

SaaS and PaaS apps

Application proxy

Device Registration

Azure AD B2B

Azure AD B2C

Azure AD Connect

AD Connect is lighweight and it comes with AD Connect Health

Self-service for profile, password, groups and apps

Delegation of groups and apps through ownership

Automatic provisioning/deprovisioning of SaaS apps

Delegate device joining/registering to end users

Smart lockout powered by machine learning

Implement if you require hybrid setup

Not required for full cloud setup

Integrates AD DS and Azure AD

Installed on a member server

Synchronized user, group and computer

Bidirectional flow of configuration changes

Single sign-on

Federation with AD FS (If authentication is on-prem)

AD Connect Health

Federated Users

Synchronized Users

Cloud Users

Source

User Type

Security groups

Office 365 groups

Dynamic membership

For cloud-only environment

Atleast Windows 10

Managed via Intune

Atleast Windows 8.1 and above

Can be configure via AD Connect tool

For BYOD

Windows and MacOS

Can enfore minimal security baseline

Manage via Intune

For partner companies

Send them email to join your tenant

Authentication is via their external Identity provider

Will soon replace ADFS and Trust

Can invite non-Microsoft identities

Customers accessing public-facing apps

Identity lifecycle is self-service

It scales to millions of users

B2C directory is isolated

Apps Gallery

One-click to provision

Integrate non-Gallery SaaS apps

Assign users and groups

Assign owners

Custome apps, in-house apps

App registration

Add a name and location

Configure cert or keys

Choose Azure API

Supports OpenID, OAuth, SAML

Assign users and groups

Assign owners

Legacy directory-aware application

Apps that require Kerberos, NTLM and LDAP

Refactor to use apps for newer protocol

Apps are running on-prem

Authentication happens in Azure AD

App proxy service (Azure AD) talks to apps proxy connector (on-prem)

Location

Rules

AI learns users login pattern

Global Administrators

flag users for risk

discover irregular activities

for monitoring and reporting

Just in time privilege