When it comes to managing user identities, IT administrators have a host of options to choose from. Often, Microsoft® tops the list of vendors considered, with Active Directory® Domain Services (AD DS) being the premier on-premises directory service on the market.
As more organizations shift their infrastructure to the cloud, options like Azure® AD (AAD) and Azure AD Domain Services (DS) present potential cloud extensions to on-prem AD. Let’s compare AD, Azure AD, and Azure AD DS and identify their strengths and weaknesses to help you assess which one is best for your organization.
Comparing Microsoft Identity Management Tools
Although there are many different aspects to identity management tools that IT admins value, we’ve honed in on a few of the most important ones in the table below:
Looking over these various capabilities, there are a few key things to note. For starters, regardless of the option chosen, Microsoft’s identity management tools struggle to manage non-Windows systems without the addition of a dedicated mobile device management (MDM) tool. As many organizations continue to adopt macOS and Linux devices, the ability to manage those devices is crucial to maintaining security.
Additionally, with each option, an on-prem Active Directory instance is required per Microsoft’s reference architecture to fully manage user identities. Users and their systems need to be on-prem (or at least connected to the on-prem network through a VPN) in order for AD to push any changes made by the admin to them. With so many of today’s organizations dealing with employees working from home due to COVID-19, it’s difficult if not impossible for a user to go into the office.
In order to keep using Active Directory to control these users, IT admins need to invest in extensive VPN infrastructure so they can tap back into the on-prem network. For many users, this process creates a source of friction as well as an additional password to deal with, unless the VPN is integrated into AD.
The biggest point of note, however, is that by buying into Microsoft’s identity management tooling suite, organizations are essentially locking themselves into the Microsoft ecosystem. Although highly effective for some organizations, others value the extensibility and inclusion that a more vendor-neutral solution can provide. Such a solution allows end users to use the resources they’re most comfortable with instead of shoehorning them into a single vendor’s offerings.
Looking over the capabilities and limitations of these three solutions, we can surmise that Microsoft’s identity management tools are great for Windows-centric organizations. For all other organizations without any Microsoft resources at-play or with a heterogeneous blend of solutions, Microsoft’s offerings won’t cover all of their identity and device management needs. These organizations ultimately have to purchase a handful of other tools to bolster their AD + AAD instances, or simply seek out another alternative altogether.
Thousands of organizations have found themselves in this very position, opting for an alternative in the form of a cloud directory service. If this possibility of an alternative to Active Directory, Azure AD, and Azure AD DS intrigues you, read how one admin switched to a cloud directory service to support his WFH user base in this case study.