Azure Active Directory, Active Directory Domain Services – What’s the difference?

Here is a subject I hear and get asked over and over again.  Is Azure Active Directory (AAD) the same as Active Directory Domain Services (AD DS).

Let me be very clear.  Azure Active Directory is NOT a cloud version of Active Directory Domain Services, and in fact, it bears minimal resemblance to its on-premises names at all.

The number one question I get asked: “How do I join my servers to Azure AD?”. IT admins expect (not unexpectedly) to be able to use Azure AD just like they have always used Active Directory Domain Services. So let’s compare AD DS (and particularly the domain services part of AD DS) to AAD.  Let me educate you 🙂

What is Active Directory?

Most of us have probably worked with it for years, and now you’re looking to move to the cloud and understand what AAD is. Let’s start with a recap of what AD DS is. 

Active Directory Domain Services was introduced as a hierarchical authentication and authorization database system to replace the flat file Domain system in use on NT4 and previous servers.

The NT4 domain model in 2000 was straining at the seams to keep up with evolving corporate structures, hampered by some quite severe limitations – maximum of 26,000 objects in a flat file “bucket”, only 5 kinds of fixed objects whose structure (properties etc.) could not be changed, maximum size of the database of 40Mb etc. NT4 Domains also primarily used NetBIOS (another flat file, Microsoft specific system) for its name resolution.

For a lot of larger organizations, this necessitated multiple domain databases with very limited and complicated interactions between those domains. Active Directory Domain Services (just called Active Directory in those days) was released with Windows Server 2000 and was based upon the X.500 hierarchical network standard that companies such as Novel’s NDS and Banyan Vines were using at the time.

AD DS also used DNS as its name resolution system and the TCP/IP communication protocols in use on the internet. It brought in the idea of a directory system which contained a “schema” database (the set of “rules” that define the properties or attributes of objects created in the “domain” database) which could be added to or “extended” to create either entirely new objects or new properties of existing objects.

Size limitations were also thrown out the window, with Microsoft creating directory systems in the billions of objects (given enough storage!) in their test labs.

Here is a list of the essential functions that make up AD DS:

  • Secure Object store, including Users, Computers and Groups
  • Object organization use OU’s, Domains and Forests
  • Common Authentication and Authorization provider
  • LDAP, NTLM, Kerberos
  • Group Policy
  • Customizable Schema

Along with Domain Services, there are also components like Certificate Services, Federation Services, and Privileged Access Management.

From its inception, AD DS quickly became the defacto directory system in most organizations, even today.

What is Azure Active Directory

So if you know what Active Directory Domain Services is, then how does this compare to Azure Active Directory? The answer to this is, not very closely. The decision to name AAD after AD, in my opinion, was more of a marketing decision than a technical one. This has lead to years of confusion. In many ways, AAD was designed for a world where PaaS and SaaS services were the default choice, not for IaaS in the cloud.

Azure Active Directory is a secure authentication store, which can contain users and groups, but that is about where the similarities end. AAD is a cloud-based identity management store for modern applications. AAD is designed to allow you to create users, groups, and applications that work with modern authentication mechanisms like SAML and OAuth.

Applications are an object that exists in AAD but not in AD DS. Applications allow you to create an identity for your applications that you can grant access for users to, and to allow you to grant your users access to applications owned by others.

What AAD does not provide is any AD DS service beyond user management.

  • You can’t join computers to an Azure AD domain in the way you would with AD DS. There is something called Azure AD Join, but this is a different animal that I’ll address below. This means there are no computer objects in your AAD to apply things like GPOs to, and no centralized control of user rights on those machines.
  • There is no Group Policy. AAD has some policy tools like conditional access, but it is more focused on access to applications.
  • No support for LDAP, directory queries all use the REST API, Graph or PowerShell/CLI
  • There’s no support for NTLM or Kerberos. AAD is modern authentication protocols only
  • There’s no schema you have access to or can modify
  • Flat structure, no OU’s, Domains or Forests

So, at this point, it’s obvious now that Azure AD is a very different thing to AD DS. AAD is for user, group and application management in the cloud. If your building all new services using PaaS or SaaS and using modern authentication protocols then you should be all set with AAD, it’s what it was designed for.

However, if your running IaaS in Azure and want AD DS to domain join machines and create GPO’s, then AAD won’t cut it for you (and that is by design).

Active Directory on Azure

Hopefully, now it’s clear what AAD is and isn’t, and if your building modern apps and AAD does what you need, then you can stop here.

However, if you are going down the IaaS route in Azure and you feel you still need the services of an AD domain, what alternatives are there?

Azure AD Join

I mentioned this briefly earlier; it is possible to join devices directly to Azure AD. AAD Join is limited to Windows 10 machines only and provides limited functionality, certainly nothing like a full AD join.

When Azure AD joined, it is then possible to login to machines using Azure AD user accounts. You can apply conditional access policies that require machines to be AAD joined before accessing resources or applications. If you’re looking for a way to provide common user account management across Windows 10 machines, then this may work for you.

Azure AD Domain Services

If you need more than just user management, then it is possible to extend Azure AD to offer more AD based services using Azure AD Domain Services. AAD DS is an Azure product that you enable on your virtual network which deploys two domain controllers. They are managed by Microsoft and synchronized with your Azure AD tenant. This allows admins to grant machine access to users in your AAD tenant, but also to implement things like custom OU’s, group policy, LDAP queries, NTLM and Kerberos.

This is a domain managed by Microsoft, so you do not have to worry about patching your domain controllers or ensuring they are up. However, it also means you do not have full control of the domain. For example, you do not have domain admin rights, only enough rights to undertake the tasks Microsoft allows. You can see a full breakdown of AAD DS limitations here.

AD Domain Controllers on Azure

Nothing is stopping you just deploying some virtual machines in Azure and turning them into domain controllers. This is a support configuration and is in use by many people who need the full suite of services provided by AD inside Azure.

The downside to this approach is that you need to manage this yourself. You need to take care of patching and updating your servers, backing up your domain and any other maintenance you require. You are also in charge of making sure it is highly available and implementing a DR strategy if you require it. If you need all that AD DS has to offer then, this can be a great option, but if all you want is a common user store for machine login, it might be overkill.

Access your On-Premises AD Domain

Finally, you can also extend your existing on-premises domain into Azure. Using ExpressRoute or VPN, you can connect your on-premises network to your Azure vNet and allow access to domain controllers. You can even deploy IaaS domain controllers in Azure that are joined to your on-premises domain. This then adds a dependency to your infrastructure of connectivity back to the on-premises network, so this connectivity becomes a key point of failure. You need to ensure that resiliency is built in.

Summary

If your new to Azure and especially identity in Azure, I hope clears things up. This is a new, modern authentication provider and is not Active Directory Domain Services in the cloud. AAD does not behave like the AD DS you know and love and really shouldn’t be compared to it, it is a different service.

If you need AD DS in your cloud environment, then there are options to achieve this, but AAD is not going to give you that. Take a look at the options listed in this blog post and see what meets your needs.

Until next time, Rob

Windows Virtual Desktop now in the Wild – Public Preview Now Available

The Windows Virtual Desktop (WVD) product and strategy announced last September is finally here in public preview.  Something near and dear to my heart for the last 6 months.  I’ve been in private preview and had to keep a lid on it 🙂 Yea!!

What is it?

Simply put, it’s multi-session Windows 10 experience with optimizations for Office 365 ProPlus, and support for Windows Server Remote Desktop Services (RDS) desktops. It means users can deploy and scale Windows desktops on Azure and on-premise quickly.

The service brings together single-user Windows 7 VDI and multi-user Windows 10 and Windows Server RDS and is hosted on any of Azure’s virtual machine tiers or what you could call DaaS (Desktop as a Service) in a way.

Licensing

Microsoft is pricing WVD aggressively by charging only for the virtual machine costs; the license requirements for the Windows 7 and Windows 10 based services will be fulfilled by Microsoft 365 F1/E3/E, Windows 10 Enterprise E3/E5, and Windows VDA subscriptions. The Windows Server-based services are similarly fulfilled by existing RDS client access licenses. This means that for many Microsoft customers, there will be no additional licensing cost for provisioning desktop computing in the cloud.

The virtual machine costs can be further reduced by using Reserved Instances that commit to purchasing certain amounts of VM time in return for lower pricing.  All of this just means simpler licensing for Office and Windows as opposed to the crazy license models of the past.  I am not saying that crazy licensing models are gone but have gotten much simpler.

What’s the deal with Windows 7 and Support?

The new service will be available to the production environments in the by June before Windows 7 support ends in January 2020.

But, there is a big incentive, Windows 7 users will receive all three years of Extended Security Updates (ESU) at no extra cost. This should ease the cost of migration to the service; this is in contrast to on-premises deployments that will cost either $25/$50/$100 for the three years of ESU availability or $50/$100/$200, depending on the precise Windows license being used.

WVD and O365

WVD will also provide particular benefits for Office 365 users. In November last year, Microsoft bought a company called FSLogix that develops software to streamline application provisioning in virtualized environments.

Outlook (with its offline data store) and OneDrive (with its synchronized file system) represent particular challenges for virtual desktops, as both applications store large amounts of data on the client machine.  This data is expected to persist across VM reboots and redeployments. FSLogix’s software allows these things to be stored on separate disk images that are seamlessly grafted onto the deployed virtual machine. WVD will use this software for clients running Office 365, but this can be optional.

Liquidware and WVD

The technology of ProfileUnity and FlexApp only complement what Microsoft includes with FSLogix.  But do understand, if you need a simple soution for Profile Disk, then FSlogix is the way to go and save yourself some money. Over my next few blog posts, I plan to show how to set up WVD and a full walk-through of FSLogix running with WVD.

Sizing WVD?

Liquidware has a product called Stratusphere UX. It’s an EUC monitoring tool that allows you to properly size your Azure environment for WVD. This helps make smart decisions on migrations to WVD.  It doesn’t stop there, Stratusphere provides ongoing metrics and alerting that help IT Pro’s to continue to maintain a high performing WVD environment into the future.

How do I get it?

Azure Market Place 🙂 The preview is available in the US East 2 and US Central Azure regions; When GA is announced, it will be available in all regions.

In Microsoft’s eyes, its time to kickass and take names 😉

Check out my next post on WVD and FSLogix.

Until next time, Rob

Hyper-V: How To Backup Virtual Machines

hyper-v backupIf you’re new to Hyper-V and wondering how to back up your virtual machines (VMs), there are different ways you can approach the task. But like most things—some options are better than others.

Below are the most common ways Hyper-V users attempt to preserve data on their VMs, with one caveat: Some of these methods should not be relied upon as your sole backup strategy. But they do serve a purpose, and they can be useful in the right situation.
Continue reading

Windows Admin Center: Strengths, Weaknesses, Enterprise Readiness and Everything Else You Need to Know

Windows Admin Center, formerly known as Project Honolulu, provides IT administrators with a unified management interface for Windows Server Management tools that were once only accessible through disparate management tools. To date, Windows Admin Center has over 250,000 unique connection instances across 25,000 customer deployments and over 50,000 downloads.

We’ve been kicking the tires of Windows Admin Center (WAC) for almost a year when we first got wind of the preview at Microsoft Ignite. Since then, we’ve monitored its progress, evaluated its strengths and weaknesses and taken a look at how it might sit in an enterprise environment. I also considered what organizations would need to complement its functionality. Continue reading

Hyper-V Failover Clusters – What You Need to Know and How 5nine Can Help

Building a Hyper-V failover plan is a critical step for any organization wishing to maintain 24/7/365 availability of their Microsoft Cloud. However, configuring Hyper-V failover clusters and managing Hyper-V hosts has its own set of unique challenges, nuances and steps. This article provides an introduction to Hyper-V failover challenges, discusses its benefits and shares some resources where virtualization administrators can access more information. Continue reading

Azure Security Center: A Complete Guide

To realize the full benefit of any cloud computing platform—Azure, AWS, or any other—you need to implement best practices related to security and compliance. All too often, data center security takes a backseat to data center design, which puts businesses at a disadvantage when it comes to keeping up with data regulations and preventing data breaches. A 2017 report from Intel Security notes that only 23% of organizations completely trust public clouds to keep their data secure. But with the right resources, it is possible for your organization to achieve both compliance and security in the cloud—without high costs, special expertise, or performance setbacks. Continue reading

Azure Stack 101: What It Is and How It Can Help Your Datacenter

Microsoft’s Azure Stack allows enterprises to run a hybrid cloud right in their own datacenters, giving them additional cloud options.

Cloud computing continues to expand in use for a wide variety of enterprises, but it all doesn’t have to happen outside your company’s datacenters. Continue reading