The difference in one paragraph
Active Directory is a directory service that runs on a server you own. It authenticates users, holds groups and permissions, and enforces settings through Group Policy. It needs a domain controller, patching, backups, and someone who understands it.
Microsoft Entra ID is the same idea run as a cloud service. It uses modern sign-in protocols, plugs straight into Microsoft 365, and is the identity layer Microsoft now builds its security controls on top of[1]. There is no server, nothing to patch, and nothing to back up.
| Active Directory | Entra ID | |
|---|---|---|
| Where it runs | A server in your office | Microsoft's cloud |
| Device settings | Group Policy | Intune |
| Server needed | Yes, a domain controller | No |
| Patching and backup | Yours | Microsoft's |
| Cost | Server, Windows licence, client licences | Included with Microsoft 365 |
| Self-service password reset | Extra product | Included |
| Conditional Access | Not available | With Entra ID P1 |
| Legacy app support | Native | Via Application Proxy or Domain Services |
When Active Directory still earns its place
Entra ID is the right answer for most small businesses. Active Directory still makes sense in a few real cases:
| Situation | What to do |
|---|---|
| Everything is Microsoft 365 and other cloud apps | Entra ID only |
| On-site file server or print server still in use | Keep AD until those services move |
| An application that can only authenticate over LDAP | Keep AD, or use Entra Domain Services |
| Industrial or isolated network equipment | Keep AD, run hybrid |
| New business, nothing installed yet | Entra ID, do not buy a server |
Most businesses in transition run both. Entra Connect synchronises users, groups and password hashes from Active Directory into Entra ID, so people sign in once with one set of credentials while the on-premises services still exist[2]. That hybrid state is normal for 6 to 12 months, not a failure.
What you get that Active Directory cannot do
Conditional Access
This is the reason to move. Conditional Access evaluates who is signing in, from where, on what device and at what risk level, then decides whether to allow, challenge or block[3]. Group Policy can restrict where someone logs in. It cannot make that decision dynamically based on device compliance, location and risk at the moment of sign-in.
Self-service password reset
Password resets are the most common support request in most small businesses. Entra ID includes self-service reset, and Microsoft's own deployment guidance treats it as a standard rollout rather than an add-on project[4]. On Active Directory it needs another product and another licence.
Passwordless sign-in
Entra ID supports passkeys, Windows Hello and FIDO2 security keys as first-class sign-in methods, so an account can exist without a password to steal[5]. Active Directory needs a password. That is not a configuration choice.
Device state as an input to access
Intune reports whether a device is enrolled, encrypted, patched and compliant, and Conditional Access can require compliance before granting access[6]. Active Directory knows the machine is on the network. That is a much weaker statement.
What it costs for 15 people
| Line | Active Directory | Entra ID with Microsoft 365 |
|---|---|---|
| Server hardware | €3,000-5,000 once | €0 |
| Windows Server and client licences | €1,200+ once, plus per user | €0 |
| Backup for the domain controller | €40-60 a month | €0 |
| Patching and maintenance | 4-8 hours a month | €0 |
| MFA and self-service reset | Extra products | Included |
| Conditional Access | Not available | Entra ID P1 |
Entra ID comes with every Microsoft 365 business plan; the Conditional Access tier is Entra ID P1, which is sold as an add-on and is also included in Microsoft 365 Business Premium[7][8]. Over three years, a domain controller for a 15-person team costs several thousand euros in hardware, licences and maintenance to deliver less than the licence you are already paying for.
The migration, in the order it actually happens
| Phase | What happens | Rough time |
|---|---|---|
| 1 | Entra Connect syncs your existing users | 1-2 days |
| 2 | Self-service password reset goes live | 1 day |
| 3 | Conditional Access policies go live in report-only, then enforced | 1-2 days |
| 4 | File shares move to SharePoint and OneDrive | 1-4 weeks |
| 5 | Print server replaced with cloud printing | About a week |
| 6 | Remaining internal apps published through Application Proxy | 1-2 weeks |
| 7 | Domain controller decommissioned | 1 day |
Phases 1 to 3 are usually done inside the first month, because they add capability without removing anything. Phases 4 to 6 take a few months and are mostly about moving files and habits. Application Proxy is what makes phase 6 possible: it publishes an internal web app through Entra ID without opening a firewall port or requiring a VPN[9]. If an application truly cannot work any other way, Entra Domain Services provides a managed directory in Azure that speaks LDAP and Kerberos, at a monthly cost that is worth checking before you commit to it[10].
Phase 7 is not urgent. It happens when the hardware reaches end of life and you simply do not replace it.
Actually
If you are starting a business today, do not buy a server. Entra ID is included with the licence you need anyway, and it does more than a domain controller ever did.
If you already run Active Directory, the migration is not urgent but it is one-directional. Start with Entra Connect and Conditional Access, then let each on-premises service move as it comes up for renewal. If you want the sequence mapped against what you actually have in the cupboard, book a free 30-minute call.