Microsoft Azure Active Directory

Microsoft Azure Active Directory (Azure AD) sits in the emerging category of Cloud IAM (Identity and Access Management), sometimes labeled IDaaS, though that term often omits the crucial “access management” dimension. In the KuppingerCole model, Cloud IAM combines cloud directory services, identity federation, access management for federated services, and modern authentication options such as social login, adaptive authentication, and step-up authentication. While not all vendors cover this full set—and many still depend on on-premises directories—Cloud IAM is positioned as a complement to traditional on-premises IAM, not a “rip and replace” alternative, especially where legacy IT must be supported.

The demand for Cloud IAM is driven by the “Computing Troika” of cloud, mobile, and social computing: organizations need rapid onboarding/offboarding, self-registration for customers, BYOD realities, and the ability to manage far more external identities (partners and potentially millions of customers) than classic employee-focused IAM models were built for. Azure AD is both Microsoft’s own IAM foundation for services like Azure and Office 365 and a customer-facing offering, demonstrating proven elasticity and massive daily scale.

Despite the name, Azure AD is not a direct cloud port of on-premises Active Directory; it is purpose-built for Cloud IAM. It includes a highly scalable directory with a fully flexible schema, multi-tenant isolation, and modern access via a REST-based Graph API rather than LDAP by default. Azure AD supports federation standards (SAML 2.0, OAuth 2.0, WS-Federation/WS-Trust), integrates with thousands of cloud services, and offers cloud provisioning when federation is unsuitable. Integration with on-premises environments is supported via synchronization (Azure AD Connect) or federation with AD FS. Azure AD is offered in Free, Basic, and Premium editions, with Premium adding features such as Multi-Factor Authentication, and is positioned as a leading-edge Cloud IAM choice for managing external users and extending on-premises Active Directory into the cloud.

• Cloud IAM is defined as a combination of cloud directory services, identity federation, access management, and support for social logins/adaptive authentication, often including step-up authentication.
• Many Cloud IAM vendors still lack highly scalable, secure cloud directory services and often consume information from on-premises directories.
• Azure Active Directory is used by Microsoft as the IAM foundation for Microsoft Azure, Microsoft Office 365, and other Microsoft cloud services.
• Azure Active Directory provides a REST-based Graph API as a primary interface for accessing directory information.
• Azure Active Directory has no LDAP interface out-of-the-box.
• Azure Active Directory supports SAML 2.0, OAuth 2.0, and WS-Federation/WS-Trust for identity federation.
• Azure Active Directory includes out-of-the-box support for thousands of cloud services, including box.com, Salesforce.com, and Google Apps.
• Azure Active Directory Connect supports synchronizing user information between on-premises Active Directory and Azure Active Directory.
• Azure Active Directory is available in Free, Basic, and Premium editions.
• The Free Azure Active Directory service includes directory services for up to 500,000 directory objects.

• “Cloud IAM needs to be understood as an extension to the existing IT and IAM infrastructure, providing new opportunities.”
• “This is not about a ‘rip and replace’ approach but about an evolution, where new capabilities are added to the existing IAM infrastructure for a seamless and integrated approach of managing identities and access.”
• “However, in contrast to its name, it is not just a port of the on-premise Microsoft Active Directory to the Cloud but a comprehensive Cloud IAM offering going well beyond the capabilities of a Directory Service.”
• “At the core of Azure Active Directory there is a directory service.”
• “The schema is fully flexible and allows dynamically adding new objects and attributes for new requirements.”
• “One of the most interesting capabilities is the way directory information is accessed.”
• “Being REST-based means that it is fairly simple for developers to access the information held in the directory.”
• “Based on these standards, Azure Active Directory allows both federation-in (relying on other IdPs) and federation-out (acting as an IdP and supporting other RPs).”
• “Overall, Microsoft delivers an excellent foundation for Access Management as a Cloud service, supporting a broad range of use cases from simple single sign-on to Cloud services… up to fully integrated, fine-grained authorization management…”
• “With its Microsoft Azure Active Directory, Microsoft doesn’t just copy that infrastructure to the Cloud.”