Microsoft Azure Active Directory

The Identity as a Service (IDaaS) market continues to expand in both vendor count and functional breadth, but the “IDaaS” label covers markedly different offerings. At its core, IDaaS delivers Identity & Access Management (IAM) as a cloud service, spanning single sign-on through full identity provisioning across on-premises and cloud applications. Solutions differ in how well they support employees, partners, and customers, mobile access, and integration back into on-premises environments. Organizations adopt access controls and access governance to manage identity lifecycles and entitlements consistently and at scale, yet these approaches must coexist with existing IAM tools because “rip and replace” is typically unrealistic. IDaaS addresses these constraints by extending IAM controls to SaaS portfolios through cloud-ready integrations, offering consistent access management with improved security and lower costs, while simplifying user access via SSO and common policies that reduce excessive or outdated privileges.

Vendor capabilities cluster into identity administration, access management (authentication, authorization, SSO, federation), and access governance, with governance generally the least mature and often missing. IDaaS is also increasingly used for Consumer IAM (CIAM), benefiting from high availability and scalability, and is overtaking on-premises IAM as a starting point for cloud-based IAM adoption.

Microsoft Azure Active Directory (Azure AD) is positioned as a comprehensive cloud IAM platform rather than a simple cloud port of Windows Server Active Directory. It targets hybrid environments with synchronization and federation, self-service password features with on-premises write-back (by edition), and SSO plus MFA even at the free tier. Authentication options include Microsoft Authenticator, OATH hardware tokens, SMS/phone verification, risk-based controls via Azure AD Identity Protection, and passwordless MFA using FIDO2/security keys and mobile-based confirmation. Azure AD supports B2B collaboration through external invitations and B2C through a standalone, white-labeled Azure AD B2C service with extensible workflows via the Identity Experience Framework and standards-based integration. Licensing progresses from Free to Premium P1/P2, while B2C uses a separate pay-as-you-go model; Azure AD also integrates into Microsoft’s Enterprise Mobility + Security suite.

• IDaaS provides IAM capabilities as a service, ranging from single sign-on to full identity provisioning for on-premises and cloud solutions.
• IDaaS offerings vary in support for employees, business partners, customers, mobile users, and on-premises integration.
• Access governance capabilities are the least mature and are largely absent from most IDaaS vendors’ portfolios.
• IDaaS is increasingly used as an enabler of Consumer Identity and Access Management (CIAM) due to availability and scalability.
• Microsoft Azure Active Directory supports B2E, B2B, and B2C use cases.
• Azure AD provides user and group management at the lowest licensing level, along with device registration and cloud self-service password changes.
• Single sign-on and multi-factor authentication are available in the free edition of Azure AD.
• Azure AD supports Microsoft Authenticator on Android, iOS, and Windows Phone.
• Azure AD supports OATH TOTP SHA-1 hardware tokens with 30- and 60-second intervals.
• Azure AD B2C supports OpenID Connect, OAuth 2, and SAML for application integration.

• “IDaaS, in general, provides Identity & Access Management capabilities as a service, ranging from Single Sign-On to full Identity Provisioning for both on-premise and cloud solutions.”
• “It must also coexist and integrate with existing on-premise and cloud-based Identity and Access Management (IAM) processes and tools since it is not practical to rip and replace these.”
• “From a business perspective, IDaaS enables organizations to manage and control access to a diverse range of cloud services in a consistent manner, securely and with lower costs.”
• “From a user perspective, IDaaS makes it easier to get access to the data and applications that they need from whatever device they are using and wherever they happen to be.”
• “Access Governance – capabilities for auditing and enforcing compliant access entitlement are the least mature and largely absent from the portfolio of most IDaaS vendors.”
• “Microsoft Azure Active Directory (Azure AD) is much more than an on-premises AD ported to Azure running as a Cloud service.”
• “Azure AD provides passwords as the one authentication method that cannot be disabled.”
• “Azure AD Identity Protection uses behavior and risk-based access controls to monitor and detect both user and sign-in risk levels.”
• “The service is white-labeled, allowing organizations to provide their own brand and customization of the user registration and login.”
• “Microsoft provides a variety of licensing options to fit a customer's needs depending on where they are on their IAM journey.”