BEMO Announces SOC 2 Type II Attestation
At BEMO, we are driven by a relentless pursuit of excellence in everything we do. Today, we are thrilled to share a significant milestone in our...
For the last six months at BEMO we have been migrating a lot of Domain Controllers to Azure. During our discovery calls with the customers, it's obvious there's a lot of confusion about all the different options around Active Directory (AD), Azure Active Directory (AAD), Hybrid Azure Active Directory (Hybrid AAD), and Azure Active Directory Domain Services (AADDS). Below we'll explain their differences in order to help you decide what you need.
Microsoft Active Directory (most often referred to as a domain controller) is the de facto directory system used today in most organizations. Active Directory is excellent for managing the authentication and authorization functions for users and computers within an organization. Its reliance upon member computers permanently joined to a domain and protocols such as LDAP for directory querying and Kerberos for directory authentication are no longer suitable for the modern Internet-centric, mobile style of work environment becoming the norm today.
Think of Active Directory as on-premise only, which means all of your authentication infrastructure is running on hardware in house.
Azure Active Directory (AAD) is a version of directory services “in the cloud” hosted on Microsoft Azure. AAD does have quite different capabilities and features compared to Windows Server Active Directory (AD). Its primary function at the moment is to manage users and the myriad of devices (Windows, Apple and Linux PC’s, tablets and smartphones, etc.) that users are employing in their work and social lives, particularly for remote users.
AAD is blurring the distinction between “on-premise" and “remote” users. AAD is the authentication and authorization mechanism for not only Azure, Office 365 and Intune, but is capable of tying in many other third-party authentication systems.
Think of Azure Active Directory as cloud only, which means if you have legacy software you will need to go with Hybrid Azure AD (HAAD).
Hybrid Azure AD is used when you have your local Active Directory (domain controller) on-premise and want to synchronize your data to Azure Active Directory. Instead of having two sets of credentials in two different places, you can add it in the ‘onsite’ domain controller, and it will replicate to Azure AD with the help of a Microsoft software add-on called Azure AD Connect.
Hybrid Azure AD is the first step in achieving one single identity. Today, most of our clients have one set of credentials to log on to their laptop and one set of credentials to log on to their email hosted on Office 365. With Hybrid Azure AD, you can set up the synchronization to Office 365 and manage the users on-premise, using your existing local Domain Controller.
Option #1: You keep your ‘on-premise’ domain controller within your physical location, and install AD Connect to synchronize your users, and their passwords, with Azure AD.
Option #2: Move your existing ‘on-premise’ domain controller into a virtual machine hosted on Azure, install AD Connect to synchronize with Azure AD, and create a VPN connection between your office and the Azure datacenter where your domain controller is now hosted.
Azure Active Directory Domain Services (AAD DS) is a standalone service in Azure that enables a domain controller for virtual machines in Azure, without setting up a standalone server as a domain controller. It creates a domain controller as a service, so you don’t need to worry about downtime, patching or other things.
What it does is that it syncs users, groups, and passwords from Azure AD to makes it available for the virtual computers in an Azure network.
You can use the Active Directory Administrative Center or Active Directory PowerShell to administer managed domains. With AADDS,
AAD DS is great for virtual machines hosted in Azure, simple to set up and works well with your Azure AD. AAD DS does NOT replace a proper domain controller and does not work with managing users and computers like with Windows Server Active Directory. AAD DS works great if you plan on a cloud-only strategy with limited users, and not GPOs.
To date, we mostly implement Hybrid Azure Active Directory by moving our clients’ existing on-premise domain controller into a virtual machine hosted on Azure, using an availability set for fail-over and redundancy capability, install AD Connect to synchronize with Azure AD and create a VPN connection between their office and the Azure datacenter. With this option, you can leverage the power of Azure while making sure your legacy application will still run.
Questions? Schedule a free meeting with us by clicking the button below:
At BEMO, we are driven by a relentless pursuit of excellence in everything we do. Today, we are thrilled to share a significant milestone in our...
In the world of business regulations, where laws and guidelines can become as complex as a mystery, there exists a steadfast guardian – the...
If you are in the market for a Compliance Provider to help you achieve attestation with a framework like SOC 2, HIPAA, NIST 800-171, ISO 27001, or...
Leave us a comment!