Why Active Directory alone is no longer enough

Many organisations have transitioned their applications, devices, and business processes to the cloud, but often find that their identity systems still heavily rely on Active Directory. This dependency can complicate operations, hinder modern security measures, and slow down the integration of new cloud and AI functionalities.

In the past, companies typically assessed identity modernisation by questioning what advantages the cloud offered over Active Directory. However, the more pressing question today focuses on the potential outcomes that a modern identity platform can provide. As cloud applications become integral to operations, and work increasingly involves not just employees but also partners, contractors, and AI, it’s essential to simplify operations, bolster security, and get ready for future challenges. The aim is not outright replacement of Active Directory but rather reducing reliance on it when cloud-based identity solutions can achieve superior results.

These signs of dependency rarely appear in isolation. If several resonate with you, it might indicate that your on-premises identity system is limiting your organisation’s progress.

Managing domain controllers, system updates, security patches, backups, disaster recovery, replication, and certificate management all require careful attention. While these tasks are critical, they often go unnoticed until something goes awry. Modernisation should refocus teams from merely maintaining infrastructure to achieving business outcomes such as enhanced authentication measures, improved governance, and streamlined automation.

On-premises Identity and Access Management (IAM) was designed for a time when being inside a corporate network implied trust. This assumption can no longer hold true when users, applications, and data exist beyond traditional boundaries. Access evaluations should now consider context rather than only network location.

The applications we rely on are mostly cloud-based, such as Microsoft 365, Salesforce, ServiceNow, and Workday. Each of these applications requires provisioning identities, establishing access controls, and securing sign-ins. When your business operations are primarily cloud-first, it makes sense for your identity management to follow suit.

Today’s workplace includes employees, contractors, partners, suppliers, and AI agents. Each identity must have appropriate access for the right duration, along with an efficient method to revoke that access when it is no longer needed. As the workforce expands, robust governance and lifecycle controls become critical to managing identity-related risks.

AI also presents new challenges concerning identity and access. AI applications and agents need specific permissions to access data, utilise services, or act on behalf of users or processes. These permissions must be stringently granted, monitored, and revoked. For many organisations, establishing a solid identity framework is the first step towards harnessing AI effectively.

If you recognise several of these signs within your organisation, the next logical step is to pinpoint the Active Directory dependencies that result in operational complexity, security vulnerabilities, or limitations on future growth.

Most organisations are already making strides in this transition. They may have a Microsoft Entra tenant, employ cloud applications, and have updated many authentication practices. The current opportunity lies in further reducing dependencies and positioning Microsoft Entra ID as the core identity platform for upcoming investments.

By making these changes, organisations can enhance security, streamline daily operations, provide more consistent user experiences, and implement identity controls across employees, partners, applications, workloads, and emerging AI agents. These improvements often signify that identity modernisation is bringing tangible business benefits that extend beyond mere technological change.

While each organisation’s landscape may vary, four key areas consistently present significant opportunities for reducing dependency, strengthening security, and simplifying operations:

1. Modernise Authentication: Transition sign-ins and multifactor authentication to Microsoft Entra ID where possible, adopt methods that resist phishing, and move away from outdated authentication protocols.
2. Transition Access Decisions to the Cloud: Implement Conditional Access and risk-based policies to assess access requests based on identity, device, application, and risk signals rather than just network location.
3. Enhance Identity Governance: Improve lifecycle management, conduct access reviews, manage entitlements, enforce privileged access controls, and strengthen governance for external and AI-related identities.
4. Minimise Dependencies on Applications, Devices, and Infrastructure: Identify workloads that still need Active Directory and prioritise efforts to modernise and lessen reliance on it over time.

Successful organisations are not focused on a massive migration project; instead, they are progressively reducing their Active Directory dependencies as applications, devices, and processes evolve. Active Directory may still serve specific legacy needs, while Microsoft Entra ID emerges as the preferred option for new authentication, access management, governance, collaboration, and AI-enabled identity scenarios.

For organisations in search of a comprehensive framework to evaluate their current state and long-term strategy, Microsoft’s Road to the Cloud guidance provides additional insights on identity modernisation strategies and planning considerations.

The signs mentioned earlier are not immediate calls to retire Active Directory. They do suggest it may be time to re-evaluate how and where identity services are delivered, as well as where to channel future investments.

A practical next step is to assess any remaining dependencies on Active Directory and focus on the four areas that can lead to significant improvements. Addressing each dependency can enhance security, simplify your operations, and position Microsoft Entra ID as a vital identity platform for what lies ahead.

Jorge Lopez

Senior Product Manager, Microsoft Entra

Jorge A Lopez | LinkedIn

Safeguard against identity breaches, ensure least privilege access, unify access controls, and enhance user experience with comprehensive identity and network access solutions across both on-premises and cloud environments.