Active Directory, formally Active Directory Domain Services, is the directory that runs on Windows Server domain controllers you own: it signs people in to domain-joined PCs, file shares and older applications using Kerberos and LDAP, and configures those PCs through Group Policy. Microsoft Entra ID, called Azure Active Directory until 2023, is Microsoft's cloud identity service: it signs people in to Microsoft 365 and other cloud apps and applies MFA and Conditional Access. They aren't old and new versions of one product, and many small businesses can now run on Entra ID alone.
This guide clears up the naming, compares what each does, explains how the two work together in a hybrid setup, and lays out what each costs as of October 2026. If your firm still has a server closet, the useful question is which jobs still need it. Our Microsoft 365 security service manages Entra ID for clients, and our Entra ID glossary entry covers the basics.
| Active Directory (AD DS) | Microsoft Entra ID | |
|---|---|---|
| Where it runs | Windows Server domain controllers you buy, patch and back up | Microsoft's cloud, as part of every Microsoft 365 tenant |
| What it signs in to | Domain-joined Windows PCs, file shares, printers and on-premises apps | Microsoft 365, Azure and SaaS apps, plus Entra joined Windows PCs |
| Protocols | Kerberos, NTLM and LDAP | Web sign-in standards such as SAML and OAuth 2.0 |
| Device settings | Group Policy | Intune, which works with Entra ID |
| Sign-in security | Password policies, certificates and smart cards | MFA, passwordless sign-in and, with P1, Conditional Access |
| SaaS apps | Needs a federation service such as AD FS | Built in, with single sign-on |
| Phones and tablets | No native support | Managed through Intune |
| Cost model | Windows Server licenses, client access licenses, hardware and upkeep | Free tier with Microsoft 365; P1 $7.00 and P2 $10.00 per user per month |
| Best fit | Offices with servers, file shares or apps that need a domain | Cloud-first offices on Microsoft 365 with laptops and remote staff |
Based on Microsoft's comparison of Active Directory and Entra ID; prices as of October 2026.
Is Azure AD the same as Active Directory?
No, and that confusion is one reason Microsoft renamed it. Azure Active Directory became Microsoft Entra ID in 2023. Microsoft announced the change on July 11, 2023 and says the new name is meant, among other things, to alleviate confusion with Windows Server Active Directory. Nothing else changed: licensing, pricing, sign-in addresses and features stayed the same, and Azure AD Premium P1 and P2 became Entra ID P1 and P2.
Windows Server Active Directory kept its name and isn't part of the Entra brand. Microsoft's naming guide renamed the tools that connect the two as well: Azure AD Connect is now Microsoft Entra Connect, and Azure AD Domain Services is now Microsoft Entra Domain Services. So Azure Active Directory vs Entra ID isn't a comparison at all. They're the same service under two names.
What is the difference between Entra ID and Active Directory?
They were built for different networks. Microsoft introduced Active Directory with Windows 2000 to manage on-premises systems with a single identity per user, and it still manages an office network well: domain-joined PCs take their settings from Group Policy, file shares check permissions against AD groups, and line-of-business apps authenticate with Kerberos or LDAP.
Entra ID was built for apps on the internet. It handles sign-in to Microsoft 365 and other SaaS apps, applies MFA, and with P1 evaluates Conditional Access on each sign-in: who the user is, where they are, and whether their device is managed and compliant. Microsoft's own comparison notes that AD doesn't support SaaS apps natively and has no native support for mobile devices, while Entra ID works with Intune to check device state during sign-in.
A Windows laptop can belong to either. Joined to AD, it gets its policies and password changes from a domain controller, which means the office network or a VPN. Joined to Entra ID, it signs in over the internet and takes its settings from Intune, and Microsoft notes that Entra joined devices still get single sign-on to on-premises resources.
Do you still need on-premises Active Directory?
Only if something still depends on it. Walk through the list:
- File servers whose folder permissions are set with AD groups.
- Applications that sign users in with LDAP, Kerberos or Windows-integrated authentication, such as older accounting, practice management or ERP systems.
- Group Policy that configures PCs in ways you haven't rebuilt in Intune.
- Network services that check Wi-Fi or VPN users against AD, often through a RADIUS server.
If none of those apply, a business on Microsoft 365 can run cloud-only: user accounts in Entra ID, Windows PCs Entra joined and managed with Intune, files in SharePoint and OneDrive. If some apply, the usual path is hybrid now and cloud-only later. Microsoft's Entra application proxy can put some on-premises apps behind Entra ID sign-in while you replace them, and Microsoft Entra Domain Services can provide a managed domain for servers that move to Azure.
How do Active Directory and Entra ID work together?
In a hybrid setup, AD stays the source of truth and a sync tool copies users and groups up to Entra ID, so people use one password for the office network and for Microsoft 365. Microsoft offers two sync tools:
- Microsoft Entra Connect Sync, the long-standing sync server that runs in your environment.
- Microsoft Entra Cloud Sync, a lightweight agent that needs only outbound connections, syncs every two minutes and is configured from the Entra admin center, according to Microsoft's Cloud Sync overview. Running agents on more than one server keeps sync going if one fails.
The older DirSync and Azure AD Sync tools no longer work. Hybrid applies to PCs too: a Microsoft Entra hybrid joined computer is joined to AD and registered in Entra ID. Microsoft describes hybrid join as an interim step on the road to Entra join, and some cloud features, such as Windows Autopilot Reset, don't support hybrid joined devices at all.
Which fits a small team?
- A new business, or one with no servers: Entra ID only. There's nothing on-premises to sync, and Business Premium includes Entra ID P1 and Intune.
- An office with a file server or an AD-dependent app: hybrid, with Cloud Sync or Connect Sync, and a written plan for retiring each dependency.
- A firm whose servers are aging: treat the hardware refresh as the decision point. Moving files to SharePoint and the app to a cloud version can remove the reason for the domain controller.
- A firm with on-premises systems it must keep: AD stays, protected and monitored, alongside Entra ID for Microsoft 365.
Whichever you choose, Entra ID isn't optional for a Microsoft 365 business. Every tenant already has it, so the real decision is whether AD stays beside it.
What does each cost?
Entra ID's free tier comes with every Microsoft 365 and Azure subscription and covers MFA, single sign-on to SaaS apps, user and group management and sync from an on-premises directory. On Microsoft's Entra pricing page, Entra ID P1 lists at $7.00 and P2 at $10.00 per user per month with an annual commitment as of October 2026. P1 is included in Business Premium and Microsoft 365 E3, and P2 in E5. Our Entra ID P1 vs P2 guide covers the choice between them.
Active Directory has no subscription, but it isn't free. As of October 2026, Microsoft lists Windows Server 2025 Standard at a suggested $1,176 for a 16-core license, and every user or device that accesses the server needs a Windows Server client access license. Add server hardware, backup, patching and the time to keep it healthy, and plan for a second domain controller so one failure doesn't stop everyone from signing in.
How does NetSys help?
We manage Entra ID for clients as part of our Microsoft 365 security work, starting with authentication methods, Conditional Access, administrator roles and app consent settings, with administrator rights made time-limited through Privileged Identity Management. For managed IT clients who still run domain controllers, our around-the-clock monitoring watches them with everything else, so a domain controller filling its system drive is worked when the alert fires. When a server refresh comes due, we price keeping it against moving each workload to the cloud on the same basis, so the decision to keep, sync or retire AD rests on numbers.
Book a call with a NetSys engineer to find out whether your domain controller can finally go; we'll walk through what still depends on it.
Frequently asked questions
Is Azure Active Directory the same as Entra ID?
Yes. Microsoft renamed Azure Active Directory to Microsoft Entra ID in 2023 without changing its features, licensing or prices, and Azure AD Premium P1 and P2 became Entra ID P1 and P2. On-premises Windows Server Active Directory is a separate product and kept its name.
Can Entra ID replace Active Directory?
For many small businesses, yes. If your PCs can be Entra joined and managed with Intune, your files live in SharePoint or OneDrive, and no application needs LDAP or Kerberos, you can run without domain controllers. Where an app or file server still needs AD, run both in a hybrid setup until that dependency is replaced.
Is on-premises AD vs Azure AD a security question?
Partly. Entra ID gives you MFA, passwordless sign-in and, with P1, Conditional Access on every sign-in, with no server of yours to patch. AD relies on passwords, certificates and smart cards, and on your own patching of domain controllers. A hybrid setup has to secure both, which is one reason firms retire AD once nothing depends on it.
What affects the cost and effort of moving off Active Directory?
The number of dependencies more than the number of users. Each file share has to move to SharePoint or another home, each AD-dependent app needs a cloud version or a bridge, and each PC has to move from domain join to Entra join, which takes planned time with each user. Support matters afterward too: someone has to own Conditional Access, device compliance and the exceptions.
Is Microsoft retiring on-premises Active Directory?
No. Microsoft says it continues to support and enhance Windows Server Active Directory for on-premises identity, because many organizations still rely on it. Retiring it is your decision, driven by what still depends on it.
Discuss microsoft 365 security hardening for your business.
Tell us about your current systems, the result you need and your timeline. We will discuss the work, responsibilities and pricing before you decide on an engagement.