Skip to main content
MI Support IT logo

Microsoft

What is Active Directory?

Active Directory manages users and permissions in Windows environments. Understand the difference between AD and Entra ID, and the typical hybrid setup.

In short

Active Directory (AD) is Microsoft's directory service, which since 2000 has served as the backbone of corporate IT environments.

AD keeps track of users, computers, groups and permissions in a Windows domain and decides who can log in to what. The service runs on-premises on domain controllers in the company's own server room, while the cloud-based counterpart Microsoft Entra ID handles identities in Microsoft 365 and other cloud services. Most Danish SMBs today run a hybrid setup, where local AD accounts are synchronised to the cloud via Entra Connect.

The most important points are that AD is still the foundation for login and permissions in many organisations, that a compromised AD often means a compromised network, and that stale accounts and overly broad administrator rights are the most common security mistakes. MI Support IT helps Danish businesses operate, secure and modernise their Active Directory, including the transition to hybrid identity and Entra ID.

Back to the glossary

What is Active Directory?

Active Directory (AD) is Microsoft's directory service for Windows networks and has been the foundation of identity and access management in businesses worldwide since Windows 2000. Active Directory keeps track of all users, computers, groups and permissions in a domain: when an employee logs in in the morning, it is AD that checks the password, and AD that decides which drives, printers and systems they can reach. The service runs on servers called domain controllers, typically located in the company's own server room or data centre.

AD on-premises vs. Entra ID in the cloud

Active Directory and Microsoft Entra ID (formerly Azure AD) are often confused, but they are two different services:

  • Active Directory is on-premises: it manages login to local machines, file servers and classic applications via protocols such as Kerberos and LDAP.
  • Entra ID is cloud-based: it manages login to Microsoft 365 and SaaS apps and supports modern security such as MFA, Conditional Access and Zero Trust.

Entra ID is not just "AD in the cloud", and Microsoft itself describes the differences thoroughly in the documentation on Microsoft Learn. New companies without local servers can often manage with Entra ID alone, while companies with local IT infrastructure typically need both.

Hybrid AD: the typical SMB setup

In practice, most Danish SMBs run hybrid: a local AD for file servers and older systems, synchronised to Entra ID so the same accounts and passwords work in Microsoft 365. The synchronisation is handled by Microsoft Entra Connect, which continuously pushes users, groups and password hashes to the cloud.

The setup works well, but it also means the local AD remains the "master": if a user is created or changed, it has to happen locally. If password synchronisation is acting up, our Tech Corner has a practical guide to forcing password sync in Entra Connect.

AD security: the classic mistakes

Because AD controls all access, it is a favourite target in ransomware attacks: if the attacker gains control of AD, they effectively control the entire network. The classic mistakes we see again and again:

  • Stale accounts: former employees and forgotten service accounts that were never deactivated are open doors into the environment.
  • Too many domain admins: rights granted "temporarily" years ago give attackers a short path to full control.
  • Missing tiering: when the same administrator account is used on both domain controllers and ordinary workstations, a single infected click can escalate to the entire domain.

An annual clean-up of accounts and permissions is some of the cheapest cybersecurity you can invest in.

How MI Support IT can help

We operate and secure Active Directory for Danish businesses: cleaning up accounts and permissions, healthy hybrid synchronisation to Entra ID and a plan for how much can usefully be moved to the cloud. This typically happens as part of Microsoft 365 operations or a full IT outsourcing partnership. Contact us if your AD is due for a service check.

Shall we talk about your business and your needs?

Real people talking to real people. We get back to you the same day.

Write to usBook a meeting