Microsoft Entra

Entra ID

Cloud based identity and access management service that provides authentication, policy enforcement, and protection for users, devices, apps, and resources

Ensures that the right people, machines and software components access the right resouces at the right time

Two Windows Server Domain Controllers are deployed as part of a replica set
These are fully managed by Microsoft and handles availability, backups and encyption
A managed domain is configured to perform a one-way synchronisation from Microsoft Entra ID
Users, groups and credentials from Entra ID are made available in the managed domain so that applications, services and VMs in Azure can use familiar AD DS capabilities such as domain join, GPO, LDAP, and Kerberoes/NTLM authentication
In hybrid environments, identity information from on-prem AD DS is synchronised to Microsoft Entra ID, and then made available to the managed domain
Domain services works with both cloud-only Microsoft Entra tenants, and tenants synchronised with an on-prem AD DS environment