Entra ID vs Active Directory: What Is the Difference?
Entra ID and Windows Server Active Directory are often confused but are fundamentally different products that solve different problems. This guide explains what each does, how they relate, and which you need.
What is Active Directory
Active Directory (AD) is an on-premises directory service for Windows networks. It manages domain-joined computers, Kerberos authentication, Group Policy, and on-premises resources. It requires domain controllers running Windows Server on-premises or in a hosted data centre.
What is Entra ID
Entra ID is Microsoft cloud identity platform. It manages Microsoft 365 authentication, SSO to SaaS applications, Conditional Access, device management via Intune, and external identities. No servers to manage - it is a service.
Key differences
Which do I need?
Frequently Asked Questions
For cloud-first organisations yes. But if you have on-premises apps that rely on Kerberos, LDAP, or domain join, you still need on-premises AD.
Yes. Intune works entirely with Entra ID. Devices enrol via Entra ID join. No on-premises AD required.
A Microsoft-managed AD-compatible service in Azure providing Kerberos and LDAP without you running domain controllers.