The core difference
Active Directory (AD) is an on-premises directory service. It manages users, computers and groups in the company network and controls settings through group policy. Microsoft Entra ID (formerly Azure AD) is Microsoft's cloud identity service. It authenticates users for cloud applications such as Microsoft 365 and modern web apps. Entra ID is not "AD in the cloud" but a different concept with different protocols.
Side by side
- Protocols: AD uses Kerberos, NTLM and LDAP; Entra ID uses OAuth 2.0, OpenID Connect and SAML.
- Device management: AD manages domain-joined devices through group policy; Entra ID works with Intune and conditional access.
- Structure: AD has domains and organisational units; Entra ID is flat and tenant-based.
- Location: AD needs domain controllers in your own network; Entra ID runs as a Microsoft service.
The three operating models
- On-premises only (AD): sensible with many classic applications, file servers and office devices.
- Hybrid: AD stays authoritative, accounts are synchronised to the cloud with Entra Connect. The most common path for mid-sized firms because it bridges transition and Microsoft 365.
- Cloud-first (Entra ID only): for companies without local servers, with cloud applications and devices managed by Intune.
How to decide
Check which applications still need Kerberos or LDAP, whether file servers and printers stay local and how many devices work outside the office. An Active Directory audit shows how clean the existing directory is before extending it to the cloud: legacy issues and excess rights would otherwise move along.