Microsoft Azure Active Directory

The Identity as a Service (IDaaS) market is expanding in size and vendor diversity, but the term covers a wide range of offerings—from basic single sign-on to full identity provisioning for on-premises and cloud environments. Organizations adopt IDaaS to implement consistent access controls and governance workflows that scale with digital transformation while still coexisting with existing IAM tools, since “rip and replace” approaches are impractical. Business benefits include consistent, secure access control across a broad SaaS portfolio at lower cost, while users gain simpler, device- and location-independent access with single sign-on and more uniform policy enforcement to reduce excessive or outdated privileges.

Most IDaaS capabilities group into identity administration (lifecycle management), access management (authentication, authorization, SSO, federation), and access governance (auditing and compliant entitlements), with governance described as the least mature area for most vendors. IDaaS is also increasingly used for CIAM due to availability and scalability, and it is positioned as a practical “springboard” for moving IAM functions to the cloud at a pace aligned with security maturity and cloud strategy.

Microsoft Azure Active Directory (Azure AD) is presented as a comprehensive cloud IAM offering designed for hybrid environments, covering B2E, B2B, and B2C. It integrates with on-premises directories via federation and synchronization, supports self-service password reset with writeback in higher editions, and provides SSO and MFA even at the free tier. Authentication options include Microsoft Authenticator, OATH hardware tokens, SMS/phone methods, and passwordless approaches (including FIDO2 keys and Windows Hello), plus risk-based controls through Azure AD Identity Protection and Conditional Access. Azure AD also offers B2B collaboration with “bring your own identity,” and a standalone Azure AD B2C service with highly customizable user flows using open standards. Licensing is layered (Free, Premium P1, Premium P2), with external identities often billed per monthly active user, and Azure AD integrates tightly with Microsoft’s Enterprise Mobility + Security suite and Microsoft Graph APIs.

• IDaaS provides IAM capabilities as a cloud service, ranging from single sign-on to full identity provisioning for on-premises and cloud solutions.
• IDaaS offerings vary in support for employees, business partners, and customers, as well as mobile use and on-premises integration.
• Most IDaaS vendor capabilities can be grouped into identity administration, access management, and access governance.
• Access governance capabilities are described as the least mature and largely absent from most IDaaS vendor portfolios.
• Azure AD supports integrating on-premises identities with cloud services and applications and also integrates with legacy authentication-based and on-premises web applications.
• Azure AD provides self-service password reset features, with on-premises writeback available in higher editions.
• Azure AD Multi-Factor Authentication supports Microsoft Authenticator on Android, iOS, and Windows Phone.
• Azure AD supports OATH TOTP SHA-1 hardware tokens with 30- and 60-second intervals.
• Azure AD B2C has no support for first-party Microsoft applications or Office 365.
• External Identities usage, including Azure AD B2C, is charged per monthly active user (MAU).

• “IDaaS offers a springboard for most organizations to start using foundational IAM elements delivered from the cloud and move the rest of the IAM functions as they find it appropriate and at a pace that matches the organizational security maturity and cloud strategy.”
• “It must also coexist and integrate with existing on-premise and cloud-based Identity and Access Management (IAM) processes and tools since it is not practical to rip and replace these.”
• “From a business perspective, IDaaS enables organizations to manage and control access to a diverse range of cloud services in a consistent manner, securely and with lower costs.”
• “From a user perspective, IDaaS makes it easier to get access to the data and applications that they need from whatever device they are using and wherever they happen to be.”
• “Access Governance – capabilities for auditing and enforcing compliant access entitlement are the least mature and largely absent from the portfolio of most IDaaS vendors.”
• “Microsoft Azure Active Directory is Microsoft’s offering for Cloud IAM.”
• “Azure AD provides passwords as the one authentication method that cannot be disabled.”
• “Azure AD Identity Protection allows organizations to use the same adaptive machine learning algorithms and heuristics that Microsoft itself uses to detect anomalies and suspicious activity.”
• “Using risk-based Conditional Access policies, organizations are given the ability to respond once a given risk threshold has been reached automatically.”
• “Microsoft Azure Active Directory is an obvious solution for many organizations when selecting their solution for authentication and single sign-on to services, and as a central element within their future Identity Fabric, a logical architecture for delivering a consistent set of Identity Services, across all types of applications and users.”