Any time that someone from Microsoft does a presentation on Windows Server or Azure, you’ll see the same image over and again; there’s a picture of a cloud that’s divided into three components that symbolize what a customer can do on-premises, what a hosting partner can offer, and what Microsoft produces from public clouds such as Intune, Azure and Office 365.
While the common denominator between the three parts of the Cloud OS is Hyper-V, the glue that holds the entire solution together is also the unique selling point that only Microsoft can offer, which is Active Directory. In this article, I’ll explain the power of Azure Active Directory (Azure AD) and how it can extend your on-premises legacy Active Directory to change how your business handles identity.
When one first hears about Azure AD, one might think “Oh! Domain controllers in the cloud.” It’s not that — yet. Microsoft recently launched a preview of Azure AD Domain Services in North American and European regions. To put it simply, Azure AD is an identity store and performs the key feature of AD in the cloud. It allows people to authenticate and authorize against cloud services.
The first of these cloud services that most businesses implement is Office 365. Even if you use one of the very simple Exchange Online plans, creating, synchronizing (using DirSync, or the replacement, Azure AD Sync), or federating (using ADFS) user accounts and passwords into these services uses Azure AD under the covers. You’ve proven by using DNS that your company owns the DNS domain of your AD, such as joeelway.com, and then you’ve made the usernames and passwords of your users available to sign into and use those cloud services.
Then you might decide, let’s use Intune or CRM Online, or any of a number of Microsoft’s enterprise cloud services. You’ll find that the user names and passwords are already there — all thanks to one identity store, a logical AD that is made up of your on-premises AD and Azure AD.
But that’s just the start. Many small-to-medium enterprises are discovering, thanks to replacing Exchange or Small Business Server with Office 365, that there is a real possibility of removing lots of other servers, such as CRM, accounting, and so on, with software-as-a-service (SaaS) applications from other vendors. The old way of dealing with this was to set up new user accounts and passwords for users in each of those services. If you talk to the owner of such a business, one of their biggest fears is if an employee leaves the company and takes access to cloud services and information to a competitor.
The solution is something that was once only possible with lots of consulting for large enterprises and educational institutions, but is now distilled into little more than a wizard: single sign-on. Azure AD makes it possible by using industry standard protocols to federate identity into over 2,500 SaaS applications, including offerings from Citrix, AWS, Google, SalesForce, and DropBox. As a result:
Single sign-on is the core reason why I think that Azure AD is so valuable, and it amazes me how few understand this power or try to implement it. Microsoft obviously understands the potential and that’s why they offer three versions of the product, each with a different price point and set of features.
The free version of Azure AD is what you get when you sign up for any of Microsoft’s cloud services. As a free product, it gives you a sample of some of the power of the future of Active Directory. I say a sample because it will make you want more, especially when you start to realize the power and the value of identity in the cloud era.
The features of Azure AD Free are:
Some features of Azure AD Free are alluring. What can we do with device registration? If users are relying on one user then that thing is starting to become valuable. And now the business is beginning to rely on Azure AD. If you start to value the features of Azure AD, then it’s time to step up the licensing (per user, through volume licensing) to get the features of Azure AD Basic, which are a superset of Azure AD Free:
Identity is now an asset of the company, and it’s time to bring the full weight of Azure AD to support this asset. You can step up by buying Azure AD Premium by itself, or take complete control of devices, applications, content, and identity with the Enterprise Mobility Suite (EMS). Azure AD Premium adds the following features to Azure AD Free and Azure AD Basic:
Microsoft has also enabled support for System for Cross-domain Identity Management (SCIM 2) in the Premium edition to further enable the provisioning of users across cloud services. This should make it easier for Microsoft, and IT pros/developers, to federate with more SaaS applications.
In my opinion, knowing Azure AD will be as essential as knowing on-premises AD, and might even replace that skill set in many cases with the eventual release of Azure AD Directory Services. When you read through what even the free Azure AD product can offer, it’s hard to fight the momentum of this hybrid cloud solution. Even more functionality is on the way, turning Azure AD into a partnering solution (Azure B2B) and a profit-making or marketing platform (Azure B2C).
For those IT pros that are scared of the cloud — folks; here’s a new skill set, a new point of management, and a business asset that you will be responsible for managing, thus ensuring your future employability if you keep your skills up to date.