Try our new research platform with insights from 80,000+ expert users
Azure Cloud Architect at a engineering company with 10,001+ employees
Real User
Access policies and MFA improve the security of our environment
Pros and Cons
  • "The user functionality enables us to provide different levels of access, across many applications, for each user. We can customize the access level and set a security level in connection with that access. For instance, we can require MFA. That is a feature that helps enhance our security posture a lot."
  • "One thing that bothers me about Azure AD is that I can't specify login hours. I have to use an on-premises instance of Active Directory if I want to specify the hours during which a user can log in. For example, if I want to restrict login to only be possible during working hours, to prevent overtime payments or to prevent lawsuits, I can't do this using only Azure AD."

What is our primary use case?

We're using Azure AD as a centralized identity management tool, to keep all identities in one place. For example, if we have an application that needs authentication, we use Azure AD. It is not only for user authentication and authorization.

We also use Azure AD as a synchronization tool from on-premises instances to the cloud, and we are using Azure ID Join to join machines directly to the cloud. We use it for access policies, as well as the registration of services.

How has it helped my organization?

With MFA, if there has been a password leak and someone tries to access the system, Azure AD will send a notification to the real user's cell phone and ask, "Are you trying to login? Please approve or decline this login." If the user declines the login, he can send a report to IT and the IT guys can automatically block the account, change the password, and review everything else. That helps us prevent unauthorized access to the system, and that's just through the use of MFA.

Through access policies, if my account was stolen and the guy got his hands on the MFA information for some reason, if the real user is in one country and the thief is in another country, the account will be blocked by our geolocation policy, even when the password is right and the MFA has been approved. We can lock it down using geolocation.

What is most valuable?

If we're talking about applications, one of the most valuable features is the administration of enterprise applications. It helps us to keep them working. We don't always need to authenticate a user to make an application work, but we do need some kind of authorization. We use service principal names for that. Managed identities for applications are very useful because we can control, using roles, what each resource can do. We can use a single identity and specify what an application can do with different resources. For example, we can use the same managed identity to say, "Hey, you can read this storage account." We can control access, across resources, using a single managed identity.

When it comes to users who have a single account, the most valuable feature is the authorization across applications. In addition, access policies help us to keep things safe. If we have a suspicious login or sign-on, we can block the account and keep the environment safe. It's also important, regarding users, to have a centralized place to put everything.

The user functionality enables us to provide different levels of access, across many applications, for each user. We can customize the access level and set a security level in connection with that access. For instance, we can require MFA. That is a feature that helps enhance our security posture a lot. And through access policies we can say, "If you just logged in here in Brazil, and you try to log in from Europe five or 10 minutes later, your login will be blocked."

What needs improvement?

One thing that bothers me about Azure AD is that I can't specify login hours. I have to use an on-premises instance of Active Directory if I want to specify the hours during which a user can log in. For example, if I want to restrict login to only be possible during working hours, to prevent overtime payments or to prevent lawsuits, I can't do this using only Azure AD.

Buyer's Guide
Microsoft Entra ID
June 2025
Learn what your peers think about Microsoft Entra ID. Get advice and tips from experienced pros sharing their opinions. Updated: June 2025.
859,579 professionals have used our research since 2012.

For how long have I used the solution?

I have been using Azure AD for the last five or six years. I have been using the on-premises solution, Active Directory, since 2005 or 2006.

What do I think about the stability of the solution?

We have never faced an outage situation with Azure AD. The stability is great, very reliable.

What do I think about the scalability of the solution?

The scalability is okay for us. While there are limitations on the number of users, it's a very huge limitation. We have not hit that limitation so far. No matter how many users or groups or SPNs (service principal names) we have, it works fast. The response takes two to three seconds if we use the API.

Currently, we have more than 5,000 users. We are at 100 percent adoption. All our users from on-premises are synced to the cloud and they are fully using the features available.

How are customer service and support?

The technical support is not going in the right direction. Sometimes the first-level support agents don't have the proper knowledge. Some of them take a lot of time to discover simple things because of that lack of knowledge. Sometimes a guy takes three or four days to give up and to ask for help from a higher level of support. The technical support can be improved in that area.

How would you rate customer service and support?

Neutral

Which solution did I use previously and why did I switch?

Before Azure AD, we either used Active Directory for on-premises or a Linux solution, but it was almost a miracle finding Linux solutions for identities. In our location, the majority of enterprises and companies are using Active Directory. The free Linux solution is basic. You can choose a user, a password, and a level of access, but it does not go as deep as Active Directory.

How was the initial setup?

The initial setup of Azure AD is very straightforward. There is even a wizard for it, making it very simple. The wizard guided us and pointed us to articles in the Microsoft Knowledge Base, in case we had any doubts about what was going on. It was a matter of "next, next, and finish."

Deployment took less than 60 minutes. It was very fast.

There are almost always issues when it comes to synching on-premises instances because they almost never follow best practices. When migrating to the cloud, there is a tool that Microsoft provides to run in your environment that tells you, "Hey, you need to fix this and this about these users, before you initiate the migration." It's complicated because on-premises solutions are like that. But if you want to have identities in Azure AD, you must have a proper set of User Principal Names, because these will be the anchor for the synchronization. If my on-premises instance has a bad UPN, it will not be able to properly sync to the cloud. But once we finished fixing the irregularities in the on-premises accounts, the migration was easy. We just installed the synchronization server and it did the job.

What was our ROI?

We have seen ROI using Azure Active Directory in the fact that we don't need to have four or five local servers. We can have just one local server and the heavy jobs can be run over the cloud. There is some money saved on that.

What's my experience with pricing, setup cost, and licensing?

The pricing for companies and businesses is okay, it's fair. 

But if you are trying to teach someone about Azure AD, there is no licensing option for that. There is a trial for one month to learn about it, but there is a need for some kind of individual licensing. For instance, I personally have an Azure tenant with Azure AD and I use this tenant to study things. It's a place where I can make a mess. But sometimes I want to do things that are blocked behind the licensing. If I were to buy that license it would be very expensive for me as an individual. It would be nice to have a "learning" license, one that is cheaper for a single person.

What other advice do I have?

Plan what you want. Think about whether you want native authentication and authorization in Azure AD. And if you want to have servers on-prem, you have to plan the kind of synchronization you want. Do you want passwords synced to the cloud or not? Instead of going headlong into using Azure AD and running into issues, the kind that require a change in access which could be problematic, plan before doing the deployment.

Disclosure: My company does not have a business relationship with this vendor other than being a customer.
PeerSpot user
reviewer1687698 - PeerSpot reviewer
Solutions Owner at a manufacturing company with 10,001+ employees
Real User
Identity and access management help improve our security posture
Pros and Cons
  • "Many of its features are valuable, including: facilitating application authentication, privileged access management, processes for attestation, and access reviews."
  • "When it comes to identity governance, the governance features in Azure AD are very focused on Microsoft products. I would like to see those governance and life cycle management features offered for non-Microsoft products connected to Azure AD."

What is our primary use case?

We have users, groups, and applications, and the purpose of this product is authentication, authorization, and attestation. We use it for the services connected to those three "A"s. The use cases in all organizations are more or less the same, even if some side services differ. Azure AD is used for authentication and authorization. It's about managing identities and granting access to applications.

How has it helped my organization?

It has features that have definitely helped to improve our security posture. The identity and access management, at the end of the day, are about security. It also offers features like multi-factor authentication, Privileged Identity Management, and access review and attestation, and all of these are connected to security and typically help improve security posture.

What is most valuable?

Many of its features are valuable, including: 

  • facilitating application authentication 
  • privileged access management 
  • processes for attestation
  • access reviews.

The multi-factor authentication, similar to when you use your mobile banking application when you want to do a transaction, doesn't rely only on your username and password. It triggers a second factor, like an SMS to your mobile. It requires another factor for authentication. This is one of the standard services Microsoft offers with Azure AD Directory.

Privileged identity management is also a standard feature of Azure AD for privileged accounts. We make sure we do privileged role activation when it's needed so that we do not have sensitive roles active every day.

What needs improvement?

A lot of aspects can be improved and Microsoft is constantly improving it. If I compare Azure AD today with what it was like five years ago, or even three years ago, a lot of areas have been improved, and from different angles. There have been improvements that offer more security and there have been some improvements in the efficiency domain. Azure AD is not a small product. It's not, say, Acrobat Reader, where I could say, "Okay, if these two features are added, it will be a perfect product." Azure is a vast platform.

But if we look at multi-factor authentication, can it be improved? Yes. Perhaps it could cope with the newest authentication protocols or offer new methods for second or third factors.

I'm also willing to go towards passwordless authentication. I don't want anyone to have passwords. I want them to authenticate using other methods, like maybe biometrics via your fingerprint or your face or a gesture. These things, together with the smart card you have, could mean no more passwords. The trends are moving in that direction.

When it comes to identity governance, the governance features in Azure AD are very focused on Microsoft products. I would like to see those governance and life cycle management features offered for non-Microsoft products connected to Azure AD. Currently, those aspects are not covered. Microsoft has started to introduce Identity Governance tools in Azure AD, and I know they are improving on them. For me, this is one of the interesting areas to explore further—and I'm looking to see what more Microsoft offers. Once they improve these areas, organizations will start to utilize Microsoft more because, in that domain, Microsoft is a bit behind. Right now, we need third-party tools to complete the circle.

In addition, sometimes meeting the principle of least privilege is not easy because the roles are not very granular. That means that if you are an administrator you need to do small things connected to resetting passwords and updating certain attributes. Sometimes I have to grant access for the purposes of user management, but it includes more access than they need. Role granularity is something that can be improved, and they are improving it.

Again, if I compare Azure AD today to what it was like three years ago, there have been a lot of improvements in all these domains. But we could also pick any of these specific feature domains in Azure AD and have in-depth discussions about what could be improved, and how.

For how long have I used the solution?

We have been using Azure Active Directory for more than five years.`

What do I think about the scalability of the solution?

Azure AD is very scalable. The only concern is around role-based access control limitations at the subscription level. That is something Microsoft is improving on. Currently, per subscription, you can have a maximum 2,000 role assignments. Sometimes big organizations hit the limit and need to implement workarounds to resolve that limitation. But that is something Microsoft has already confirmed it is improving. That is a limitation of the Azure platform, it's not specific to my organization. A smaller organization may never hit the limit, but bigger organizations do.

Apart from that, their application integrations, the service, MFA, and everything else, are quite scalable. It is moving in the right direction.

How was the initial setup?

Setting up Azure AD, is about moving toward the cloud journey. I cannot say setting up Azure AD is easy, but on the other hand, organizations are not moving to the cloud in one go. It's not all or nothing, that you have it or you don't have it. It depends on which services you are receiving from Azure AD. Some organizations, like ours, start with a limited number of services.

You usually start with syncing your identities to the cloud so that you can offer your employees certain cloud services. You want to enable them to use certain SaaS applications, where they are relying on a cloud identity, and that's why you need to have your accounts in the cloud. Without that, you cannot grant them access.

Later, you may offer the ability for business partners to use and benefit from certain cloud applications, and gradually the use cases increase. For example, someone may become a privileged user to take responsibility for an application and manage it. When that happens you start to think about what other features in the Azure platform you can offer to do administration in a more secure way. Or, once you have thousands of users benefiting from cloud applications, how can you make sure that you protect their assets and their data? That leads you to start implementing other security features, such as multi-factor authentication. Over time, you may have users benefiting from Office 365 and they need to collaborate by using Teams and SharePoint. Again, you start to build something else around that.

Whether large or small, organizations are on a journey, where they start from on-premises with servers and all these server rooms and applications in the organization. They then shift workloads to the cloud. That process is still ongoing in my organization and in many organizations. Ten years ago, workloads were all on-premises. Five years ago, maybe 90 percent were on-premises. Today it might be 50 percent cloud and 50 percent on-premises. There is value from the cloud: elasticity and flexibility, even for big organizations. A server on-premises is a different story compared to having it on the cloud. If I need to upgrade a server on the cloud, it takes five minutes. If it's on-premises, I need to order hardware and then change the hardware. The usage of Azure Active Directory is due to the evolution of the cloud.

The bottom line is that the implementation is gradual. It's not difficult or easy, although we started with things that were easy to adopt, and then we continued the journey.

The staff required for maintenance of Azure AD depends on how you organize your support. Some organizations outsource their end-user support to other companies, while other organizations staff that completely internally. It can also depend on the users. Is your organization a global organization or a small, local organization? For us, to make sure we maintain the support and availability and all the services we need, including change management, we need at least 15 to 20 resources for a global application with more than 20,000 users, to maintain the platform.

What about the implementation team?

We worked with a lot of consultants for Azure AD. There are many features and no one expert or professional can help with all aspects. Organizations, during their journeys, have to work with different partners and integrators. It may be that there is a specific application you need to integrate with Azure AD and you need some skills there. It may be that you want to better manage Azure resources, so you would talk to a different type of resource. You may want to increase your identity security scores, depending on how you configure Azure AD, and for that, you would need to talk to an Azure security expert. I think this applies to all big enterprises. We need different skills to better utilize Azure, including Azure AD, and to do processes in a more secure way.

We have Microsoft Professional Services. That's the primary source for many organizations that are utilizing Microsoft services. If you have an enterprise agreement or a unified agreement with Microsoft, they offer you consulting services. Of course, you have to pay for Professional Services, but we get value there. The number-one consulting and integration support provider is Microsoft.

They also work with certified partners like Accenture or Avanade. These organizations are connected with Microsoft and they offer consultancy services to enterprises like ours. Depending on the subject, we may use services from any of these providers. We usually go with Microsoft-certified partners.

What other advice do I have?

Multi-factor authentication means you need to do an extra step, but that is normal because the attack surface is wider. We want to make sure you are who you say you are. That extra step impacts the end-user experience, but it's needed. The way authentication happens today is far different from 10 years ago. It may result in some added difficulty, but it is there to protect employees, organizations, customers, business partners, IT assets, data, et cetera.

Disclosure: My company does not have a business relationship with this vendor other than being a customer.
PeerSpot user
Buyer's Guide
Microsoft Entra ID
June 2025
Learn what your peers think about Microsoft Entra ID. Get advice and tips from experienced pros sharing their opinions. Updated: June 2025.
859,579 professionals have used our research since 2012.
Sr Systems Engineer at a tech services company with 10,001+ employees
Real User
Strong authentication feature for on-prem and hybrid configurations
Pros and Cons
  • "The feature that I have found most valuable is its authentication security. That is Azure Active Directory's purpose - making cloud services' security and integration easier."
  • "In terms of stability, sometimes the more applications you integrate, the more it becomes a little bit unstable."

What is our primary use case?

My primary use case with Azure Active Directory is configuring applications, for example Edge, on premises and doing synchronizations with ADFS in a hybrid environment.

I have used it in a lot of application integrations. I set authentication for the hybrid and cloud applications for the services that we acquire.

What is most valuable?

The feature that I have found most valuable is its authentication security. That is Azure Active Directory's purpose - making cloud services' security and integration easier.

What needs improvement?

In terms of what could be improved, I would say its interface is not very flexible, as opposed to AWS.

The services are very clear, but the user admin interface needs to be better. That's all.

For how long have I used the solution?

I have been using Azure Active Directory for more than five years.

What do I think about the stability of the solution?

In terms of stability, sometimes the more applications you integrate, the more it becomes a little bit unstable. The synchronization engine is key because that's what 365on-premises is for. The main thing that Azure supports is Microsoft native 365 and the other services that come with it.

What do I think about the scalability of the solution?

It is scalable. It is just that Microsoft likes complex licensing. They should make it more  straightforward.

We just have the admins using it, that's about 20 people.

How are customer service and support?

Microsoft tech support is not the best, but they're okay.

How was the initial setup?

The initial setup is not that complex. Maybe I'm the wrong person to ask, though, because I am already an old AD person and I understand it.

What other advice do I have?

On a scale of one to ten, I would not rate Azure Active Directory as a bad product, I would rate it as an 8.

Disclosure: My company has a business relationship with this vendor other than being a customer. Partner
PeerSpot user
Consultant at Upwork Freelancer
Real User
Eliminates the need for VPNs and enables conditional access based on a user's location
Pros and Cons
  • "Conditional Access, Geofencing, and Azure Multi-Factor Authentication are the major security features to secure resources."
  • "We have a lot of freedom in using the Group Policy Objects and, although Group Policy Objects are part of Azure Active Directory, there are still a lot of things that can be improved, such as providing local admin rights to a user. There are various, easy ways that I can do that in the on-premises version, but in the cloud version, it is a bit difficult. You have to create a bunch of policies to make it work."

What is our primary use case?

The use cases depend on my clients' specifications. If they have the on-premises Active Directory and it is a hybrid environment, then objects are synchronized with the cloud in Azure Active Directory. Services that are on-premises or in the cloud are synchronized with each other, to create a centralized management solution. 

If we're talking about Azure Active Directory only, the cloud-based, centralized management solution, we don't need to use a VPN to access the resources; everything is cloud. We just need to be connected with Azure Active Directory and we can use the resources anywhere in the world and resource security will be intact.

I use both the cloud and on-premises versions.

How has it helped my organization?

Everybody is moving from on-premises to Azure Active Directory because it's cost-effective. They don't need to spend a lot of money on the on-premises resources, such as an on-premises server and maintenance. Now, given that Microsoft has started Windows 365, which is a PC in the cloud, you don't need to have a PC. You can work on an Android tablet from anywhere in the world, using cloud technology.

In terms of the user experience, because the solution is in a cloud environment, people are not bound to work in a specific network. In the old-school way, if you worked from home and you had on-premises Active Directory, you needed to use a VPN. VPNs can be highly unstable because they depend on your home network. If your home network is not good, you won't get the same bandwidth as you would get when using the resources inside the office network. With Active Directory in the cloud, you can use your own network to access the resources. It's faster, reliable, and it's cheaper compared to Active Directory on-premises.

What is most valuable?

  • Conditional Access
  • Geofencing
  • Azure Multi-Factor Authentication

are the major security features to secure resources.

For example, if I don't want users using the company resources outside of India, I will add managed countries within Conditional Access. Only the people from the managed country will be able to access things. If an employee goes out of India and tries to access the resources that have been restricted, they will not be able to open the portal to access the resources.

What needs improvement?

We have a lot of freedom in using the Group Policy Objects and, although Group Policy Objects are part of Azure Active Directory, there are still a lot of things that can be improved, such as providing local admin rights to a user. There are various, easy ways that I can do that in the on-premises version, but in the cloud version, it is a bit difficult. You have to create a bunch of policies to make it work.

For how long have I used the solution?

I have been using Azure Active Directory for six years.

How are customer service and support?

Microsoft works with suppliers and vendors. Certain vendors are very good at providing support and certain vendors are not very good at providing support. It depends on the time zone in which we are opening a ticket and which vendor the ticket is going to.

How would you rate customer service and support?

Positive

How was the initial setup?

It's pretty straightforward in general, although it depends on what kind of requirements a client has.

If I'm deploying with Microsoft Autopilot, it usually takes at least 40 to 50 minutes to deploy one machine. If I'm deploying 1,000 machines in one go, you can multiply that 40 minutes for each of those 1,000 machines. Everything is configured in the cloud, in Azure Active Directory. You just need to purchase the machine, configure things, and ship the machine to the user. When they turn it on they will be able to work on it. Everything will be installed in the backend. If it's not on Autopilot, it's just in a matter of a few clicks to connect the machine to Azure Active Directory.

The deployment plan also depends on the client. If the client is not providing machines to their employees, they want the machine to be BYOD, we will work on the existing computer. In that case, we just set up the policies and ask the user to connect to Azure Active Directory. But if a client is concerned about complete security, and they want the machine to be used in a certain way, and they are providing the machine, then I prefer that it should be Autopilot. It becomes an enterprise-managed machine, and we have more control over it.

What was our ROI?

Clients only invest their money when they know that they are getting a really helpful platform. They want to see that I, as a consultant, am confident in the product I'm asking them to use. I have to be very confident that I am providing them a solution that will definitely work for them.

What other advice do I have?

People have a tendency to keep their information in-house, but the cost of keeping information on-premises in SharePoint servers is very expensive. There is a good chance that, if something happens, they will lose the database. There is no backup. And to keep a backup, you have to pay more for a cloud backup solution to keep your data on another server. You are compromising with your data in a two-sided scenario, where one is on-premises and the other is on a data server as a backup. If you go for the cloud version of Active Directory, everything is secure and everything is in the Microsoft data center, which is reliable and secure. They have disaster management and recovery. That's a win-win situation.

My work is generally on device management, which is on Intune, Endpoint Manager, and Cloud App Security. These all work hand-in-hand. Azure Active Directory is just an assembler of management resources, but Intune makes the device secure. The policies create restrictions. These things work together. If you need Active Directory, you will definitely need Intune.

The largest deployment I worked on with one of my clients was about 2,500 computers. As far as managing them goes, it varies, between 200 to 300 computers at one time in one environment. If I'm working on providing a day-to-day solution, it is different because the queries are different. People usually have problems related to smaller queries, like their printer is not connecting, or they are not able to access SharePoint, or they do not have permissions for a given file. But as far as deployment and designing the architecture of Azure Active Directory goes, I work with midsize companies.

To summarize, the big advantages of this platform are the reliability, cost-effectiveness, and security. These are the features that make it one of the best solutions in the IT industry. Azure AD is the future. Everyone is adopting the cloud environment. I, myself, use Azure Active Directory for my own devices and resources. I encourage other people to accept the future. It gives you more security than the on-premises Active Directory. To me, it is the best solution.

Disclosure: My company does not have a business relationship with this vendor other than being a customer.
PeerSpot user
it_user1475160 - PeerSpot reviewer
Sr Engineer IT at Hical Technologies Pvt Ltd
Real User
Enables us to see and analyze user activity and gives us a single point of control
Pros and Cons
  • "It also has features that help improve security posture. The most important of these features include multifactor authentication, which is very useful for connecting to the organization, especially from outside the boundaries of the organization. That is very helpful when it comes to user security."
  • "Everything should be in one package. There are so many different packages. They need to provide guidance because there are so many features and we don't know how to implement them in our organization."

What is our primary use case?

We use Azure AD for user access and control.

Our deployment is a hybrid of on-premises and cloud.

How has it helped my organization?

We can see user activity and analyze user interaction between the websites and log files. It gives us a single point of control. Overall it has helped place our security posture in a good position.

In addition, using Microsoft Endpoint Manager, new laptops can easily connect to the MDM solution, making for a very good user experience, particularly for new systems. Users just log in with their email ID and multifactor authentication. Once they are logged in, they connect automatically to the back end and that helps make the user experience for configuration very good.

What is most valuable?

Among the valuable features are MDM and Microsoft Endpoint Manager. They are very useful. Intune is built-in. And deploying to MDM has features that are very advanced. It reduces the administration work. And security-wise, it has very advanced technology.

It also has features that help improve security posture. The most important of these features include multifactor authentication, which is very useful for connecting to the organization, especially from outside the boundaries of the organization. That is very helpful when it comes to user security. And in the COVID situation, MDM is very helpful for us due to work-from-home. It enables us to very easily connect to our domain and align new systems with the end-users. That is very helpful for us.

What needs improvement?

There are some difficulties in the hybrid version, things to do with firewall security, inside the organization. They need to work on that more.

In addition, everything should be in one package. There are so many different packages. They need to provide guidance because there are so many features and we don't know how to implement them in our organization.

I'm also expecting a Windows 365 virtual desktop. I would be interested in that feature.

For how long have I used the solution?

I have been using Azure Active Directory for four years.

What do I think about the stability of the solution?

It's 100 percent stable.

What do I think about the scalability of the solution?

The scalability is unlimited.

How are customer service and technical support?

I would rate Microsoft's support at nine out of 10. It's not a 10 because in some cases they don't answer a call because they are engaged with other calls.

Which solution did I use previously and why did I switch?

We tried ManageEngine but it was not useful for us. It was not up to the requirements of our organization. Azure AD is a very flexible solution. It is used in most of the organization.

How was the initial setup?

It is very easy to configure if you are configuring a completely new cloud deployment. But with the on-premises deployment, there are some difficulties due to security issues, like credentials required.

It doesn't take more time to install AD Connect on-premises. The installation itself takes one hour and, within one to two days, we can take all the data over to it. But we then need to monitor it for at least two days to make sure everything is fine.

We have almost 400 users in our AD and we have six people involved in maintaining and administering it, including me in my role as senior IT engineer. I take care of Active Directory monitoring, as well as installation and configuration. We also handle patches and upgrades. One person takes care of the billing part.

What about the implementation team?

We set it up with the help of a consultant from KPMG and our experience with him was good.

What was our ROI?

With COVID going on, part of our ROI from using the solution is that we can view the access of all the employees who are working from home. In these circumstances, that has been a notable return on our investment. 

What's my experience with pricing, setup cost, and licensing?

The pricing, in the context of the COVID situation, is very high because the overseas aerospace industry, to which we supply products, has been hugely impacted. There are no projects coming in. 

The pricing should also be less for smaller organizations.

Disclosure: My company does not have a business relationship with this vendor other than being a customer.
PeerSpot user
Computer engineering student at a educational organization with 501-1,000 employees
Real User
Good functionality for role and access definition, with helpful support material available online
Pros and Cons
  • "As an end-user, the access to shared resources that I get from using this product is very helpful."
  • "The most challenging aspect I found was the creation of organizational units and specific domains. They have a tool called Bastion, which is expensive and a little bit confusing."

What is our primary use case?

I'm a computer engineering student in Portugal, and we used it during one of our classes for practically the whole semester. We used both the on-premise solution and the Azure, online one.

While we were learning, we used it primarily for user access management and also to define rules for the organization. For example, we created organizational units and defined domains for enterprise-level organizations. I was able to specify access to, for example, certain folders, including shared folders and shared resources.

We were using it in conjunction with SQL Server 2019.

How has it helped my organization?

Azure Active Directory works well to access the resources that the school has set up for the students. We can share between our groups, and we can set up shared assignments or shared project folders very quickly and easily.

We have access to shared storage space, which is great. It is managed through Azure Active Directory and appears to me as a Microsoft OneDrive account.

As an end-user, the access to shared resources that I get from using this product is very helpful. I also use it for my email, which is a domain that is part of the organization. 

What is most valuable?

The most valuable feature is the ability to define certain roles for the users and to give access to shared resources.

The options for user access management on the cloud are similar to those with the on-premises deployment. You can work directly on the cloud but control it from your on-premises server if you want, or you can make all of the changes directly on Azure.

One of the security features that Azure Active Directory provides is that it warns users about the usage of weak passwords. When we created user accounts and their passwords, it warned us about weak passwords and gave us the option to define password creation rules. We tested the feature and tried using invalid passwords, and it blocked access to the organizational units accordingly. We did not work with the more advanced security features within the scope of the course.

It has some good monitoring options that you can use to see how well it is working. In my class, we were able to see which users were accessing the solution, and what went wrong with the tests that we were doing.

What needs improvement?

The most challenging aspect I found was the creation of organizational units and specific domains. They have a tool called Bastion, which is expensive and a little bit confusing. I had to cancel the subscription because it was using my credits too quickly. For the students, it was not a very cheap way to learn it.

It would be helpful if they provided more credits for students who are performing test cases because we had to be really careful when we were using it. Making it cheaper for students would be great.

For how long have I used the solution?

I have been using Azure Active Directory for one school semester.

What do I think about the stability of the solution?

Because we weren't using it on a large scale, it is difficult to estimate how good the stability is. That said, it worked fine for the small number of users that we had. Although it was not a good test, I think that it worked fine. It does have some good monitoring options, so we could watch the performance.

What do I think about the scalability of the solution?

I do not have large-scale experience with this product, as I was using it for practice during my degree program. I don't know at this point whether I will be using it in the future.

In my class, there were half a dozen or fewer users.

In order for the solution to be scalable, it requires some upfront work. You have to well define the users, profiles, and roles that you want to have at your organization. We were already given some advice on that from our teachers, including which roles we should create and so forth. Once you have that done, I think it's pretty straightforward. You just have to add them through the interface that the solution has, and it's not very difficult to do.

How are customer service and technical support?

I did not have to contact Microsoft technical support.

Our teachers explained what it was that they wanted us to implement and we were left to figure out how to accomplish the tasks on our own. When problems arose, I used Google to search for answers online. I also watched YouTube videos that included explanations and step-by-step tutorials.

Which solution did I use previously and why did I switch?

Another solution that we learned about was the Apache Web Server. You can do the same things that you do with Azure, but it's more complex. You have to know a little bit more about Linux and you have to do it more manually.

In Azure Active Directory, there are already some default options available. That worked for us. It's easier for someone who doesn't want to have the headaches of understanding some of the more minor details.

How was the initial setup?

For the initial setup, we mainly followed the tutorials that Microsoft has online. Initially, it was a little bit confusing because we discovered that there are many different versions of this same software. There are distinctions between an on-premise way of doing things versus a hybrid approach versus something that is on the cloud exclusively. There are limitations that each one of them has, as well as other differences that include mobile versus desktop solutions.

For a newbie like me, it was a little bit challenging to understand what the best approach would be. In this case, we were oriented by the teachers to implement the hybrid approach. When we were configuring Azure Active Directory for this, and also for the organizational units, we used the Bastion service. It is the one that creates the domains.

The deployment took perhaps half a day to complete the configuration, step by step. We had to make corrections between configurations, where we had made errors, which was part of the learning process. Overall, when you really know what it is that you have to do, it's pretty straightforward and quick to complete. Otherwise, it will take you a little bit longer.

From the documents that Microsoft has available, we understood that there are several ways to deploy this solution. There is an on-premises version, a cloud-based SaaS, and a hybrid option. 

We were using virtual machines with a license that was connected to our educational package. We have a product key, install it locally on the virtual machine, and that's how we worked with it. At that point, it was connected to the cloud.

Our Azure accounts are related to our college email address, and they are also administered by Active Directory.

What about the implementation team?

We deployed it ourselves. With our small group and for the length of time that we used it, we did not perform any maintenance and I don't know how it is normally done on a day-to-day basis. Based on what I have learned, I think that one or two people are sufficient for maintenance if they know the product from head to toe.

What was our ROI?

Based on my experience, it would be difficult to estimate how long it would take to earn your investment back.

What's my experience with pricing, setup cost, and licensing?

As this was being used in an academic setting, we were using the educational package. Azure has an educational package available for students with a variety of licenses and different software available. One of the applications included with this is the Azure SQL Server.

Each of the student accounts had an opening balance of $100 USD in credits. We used that to implement the solution and the code doesn't change if you are a student or a normal organization. Some of the things that we wanted to do were blocked by the organization, so we had to use our personal accounts. When we used our credits in this way, it was not specifically for students but for anybody who uses the service.

These credits are used on a pay-per-use basis and the price depends on the features that you use. The most expensive one that was relevant to our use case was Bastion, which allowed us to create and configure virtual subnets. Our use case required us to use it to connect our on-premises Windows Server with the cloud AD.

What other advice do I have?

My advice for anybody who is implementing Azure AD is to study the basics. Get to learn how this access management solution works. We used Microsoft Learn and YouTube videos to assist us with doing so.

In summary, this is a complete solution for any company, but it requires some time and practice.

I would rate this solution a nine out of ten.

Which deployment model are you using for this solution?

Public Cloud

If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?

Microsoft Azure
Disclosure: My company has a business relationship with this vendor other than being a customer. Partner
PeerSpot user
reviewer1258218 - PeerSpot reviewer
Director of Cybersecurity Solutions at a computer software company with 501-1,000 employees
MSP
Centralizes usernames and credentials, perfectly stable, and good support
Pros and Cons
  • "It certainly centralizes usernames, and it certainly centralizes credentials. Companies have different tolerances for synchronizing those credentials versus redirecting to on-prem. The use case of maturing into the cloud helps from a SaaS adoption standpoint, and it also tends to be the jumping-off point for larger organizations to start doing PaaS and infrastructure as a service. So, platform as a service and infrastructure as a service kind of dovetail off the Active Directory synchronization piece and the email and SharePoint. It becomes a natural step for people, who wouldn't normally do infrastructure as a service, because they're already exposed to this, and they have already set up their email and SharePoint there. All of the components are there."
  • "Its area of improvement is more about the synchronization of accounts and the intervals for that. Sometimes, there're customers with other network challenges, and it takes a while for synchronization to happen to the cloud. There is some component of their on-prem that is delaying things getting to the cloud. The turnaround time for these requests is very time-sensitive. I don't mean this as derogatory for this service, but in my experience, that happens a lot."

What is our primary use case?

Usually, it is replicating an on-prem Active Directory environment into Azure. It is usually tied with generic email access and SharePoint Online access and building out provisioning for that. There typically is some sort of synchronization tool that is sometimes used in addition to or as a substitute for the typical Microsoft suite. So, it just depends upon the customers and how they're getting that information up there.

In terms of version, it tends to be a mixed bag. It just depends on the client environment and factors such as the maturity and the rigors of change management. Sometimes, it just lags, and we've dealt with those types of situations, but more often than not, it is more of a greener field Azure environment and tends to be the latest and greatest.

What is most valuable?

It certainly centralizes usernames, and it certainly centralizes credentials. Companies have different tolerances for synchronizing those credentials versus redirecting to on-prem. The use case of maturing into the cloud helps from a SaaS adoption standpoint, and it also tends to be the jumping-off point for larger organizations to start doing PaaS and infrastructure as a service. So, platform as a service and infrastructure as a service kind of dovetail off the Active Directory synchronization piece and the email and SharePoint. It becomes a natural step for people, who wouldn't normally do infrastructure as a service, because they're already exposed to this, and they have already set up their email and SharePoint there. All of the components are there.

What needs improvement?

Its area of improvement is more about the synchronization of accounts and the intervals for that. Sometimes, there're customers with other network challenges, and it takes a while for synchronization to happen to the cloud. There is some component of their on-prem that is delaying things getting to the cloud. The turnaround time for these requests is very time-sensitive. I don't mean this as derogatory for this service, but in my experience, that happens a lot. 

For the Active Directory component, there are some value differences and things like that as compared to on-prem. I have run into problems a few times when there is a custom schema involved with their on-prem installation. You can use it, but that custom schema or functionality is going to have to go somewhere else or rerouted back to on-prem.

For how long have I used the solution?

I have been using this solution for probably two and a half years.

What do I think about the stability of the solution?

It is perfectly stable. I haven't had any concerns or any problems with that.

How are customer service and technical support?

I have dealt with them. Overall, tech support is great if you have something that was working but it's broken and needs to get fixed. It is a different bucket if you have more of an implementation question like, "Hey, can we do this?", or "How to approach that?" Sometimes, it can be challenging to get the right people on that call to support those conversations.

How was the initial setup?

Its initial setup really depends on the customer. I have one customer right now with a super simple environment. They're just replicating it up. It's all Microsoft stack top to bottom with no real surprises or anything else. They're happy as pie with that. 

I have larger customers who tend to want some sort of management layer on top of it for Active Directory management purposes. This tends to go into the cloud, which introduces its own little challenges. In a more sophisticated enterprise, I start running into custom schema or workflow dependencies that just don't translate well from on-prem to cloud, but it is rare. It usually ends up being a third-party solution that we route them to with that. So, it's not huge. The challenge is more in identifying that. Typically, as much as we try, we rarely get it identified early enough to change our statement of work or our implementation, so it becomes a bad surprise.

What's my experience with pricing, setup cost, and licensing?

Its price is per user. It is also based on the type of user that you're synchronizing up there.

What other advice do I have?

I would advise spending more time on planning and aligning your business processes with Active Directory and Azure in terms of custom schema and separating third-party accounts, external accounts, or customer's accounts from employee accounts. I've run into issues when people take an existing on-prem solution that has third-party entities or maybe external customers and start synchronizing it up. It is not a slam against the service, but that's where I start recommending people to do different instances of Azure Tenants to break that up a little bit and provide that separation. All of these are planning functions. Using this service can be deceptively easy, but you should spend more time on planning. Around 80% of it is planning, and the rest of it is the implementation.

I would rate Azure Active Directory an eight out of 10. It is super solid. I wouldn't say it's the best. I would love to have everything that you could do on-prem. I understand why it can't do that, but I would love that flexibility.

Disclosure: My company has a business relationship with this vendor other than being a customer. Implementer
PeerSpot user
Founder, CEO at a computer software company with 11-50 employees
Real User
With multi-factor authentication, we've seen a marked decrease in the number of threats we've seen come through
Pros and Cons
  • "Being able to use Azure AD means that you can use some of the Azure AD security features like Advanced Password Protection. As well as querying your normal password requirements like lengths and complexity, Azure AD has a feature in which you can put specific words. It can be words to do with your company, words to do with your company location, or words that a lot of your employees would otherwise use. You can disallow them. It's very good at making more obvious passwords, ones they're not allowed to use anymore. That's a good feature."
  • "The conditional access rules are a little limiting. There's greater scope for the variety of rules and conditions you could put in that rules around a more factual authentication for other users. If you have an Azure AD setup, you can then connect to other people's Azure AD, but you don't have a huge amount of control in terms of what you can do. Greater control over guest users and guest access would be better. It's pretty good as it is but that could be improved."

What is our primary use case?

We use it for all of our internal colleagues. Every single user is synced from our internal on-prem directory to Azure AD. Every single user has a presence in Azure AD and that account or identity is then used for at least 10 to 15 different applications. They directly query what groups they're a member of within Azure AD. We use Azure AD for at least 15 different applications.

How has it helped my organization?

It has improved our security posture. Not only with the password feature but there were also things like conditional access, applications within Azure that you can use for better access. You can put conditional access rules in front of those applications, which means that either the device that they're accessing it with has to have a certain up-to-date version of antivirus, it has to have all of its Windows updates, or they have to use multi-factor authentication. All of those nice-to-have features help our security posture a lot.

When users are in Active Directory they can use single sign-on, which means once they've signed on to their machine, they then don't have to sign on again when they access things like their email. They can just go to those URLs. Because those applications are attached to our Azure AD and to our Azure tenant, they can just go to the applications. Those applications know who they are because they have a single sign-on enabled. So that has helped them so they don't have to turn on passwords when they have to access all these different applications.

What is most valuable?

Being able to integrate with third-party solutions is the most valuable feature. These are solutions that produced software as a service and we haven't then had to bring that service to our own data or in our own directory. We can use our Azure identity to connect to their solution. Being able to connect to third-party applications in these identities is the best thing we've found.

Being able to use Azure AD means that you can use some of the Azure AD security features like Advanced Password Protection. As well as querying your normal password requirements like lengths and complexity, Azure AD has a feature in which you can put specific words. It can be words to do with your company, words to do with your company location, or words that a lot of your employees would otherwise use. You can disallow them. It's very good at making more obvious passwords, ones they're not allowed to use anymore. That's a good feature.

It has something called Dynamic Groups so that when a user joins the company and they get added to specific groups, Azure AD will add them dynamically to other groups that will give them access to some of the base applications.

We have certain sets of software that they have to be able to access. Instead of somebody who deals with new users having to add them into 20 different application groups, you need access to this, this, and this. The Dynamic Group update feature from Azure AD means that you can just put them in one group and say that they have a role, and it will automatically then add them to about six or seven other groups, giving them default access to other things as well, instead of having to do that. It means there's a lot less manual work when you get new employees.

What needs improvement?

The conditional access rules are a little limiting. There's greater scope for the variety of rules and conditions you could put in that rules around a more factual authentication for other users. If you have an Azure AD setup, you can then connect to other people's Azure AD, but you don't have a huge amount of control in terms of what you can do. Greater control over guest users and guest access would be better. It's pretty good as it is but that could be improved.

For how long have I used the solution?

I have been using Active Directory in my current role for around six months and in a previous role for three years. I recently moved companies about three months ago. Before that, I was working for another company. I was there for about five years and for at least half that time I was using Azure AD. 

We use the latest version. Azure AD doesn't really have version numbers, it's an evolving platform. In my current role, we're on the latest version of it. 

What do I think about the stability of the solution?

Stability is pretty good. In the lifetime of me using it, there have been outages of certain features within Azure. We use multi-factor authentication. There have been times when that authentication feature has gone down and people couldn't access things that required that when they log on. That has happened maybe twice in the last 15 or so years. So it's pretty good. The uptime is pretty good, but it's not 100%.

What do I think about the scalability of the solution?

The company I used to previously work for had 90,000 users that were synced. That was nothing. There was room for loads more. I think they have a limit of a million or something objects within Azure AD. That's something you can ask to have increased if that's a requirement. Scalability is pretty unlimited. There is no issue there at all.

In the company I used to work for there were 90,000 people connected to Azure AD. As soon as they logged on, they were using Azure AD. In the current company, it's nearer five or 6,000, but all of those accounts have access to Azure AD. 

There are various roles including administrators who will have the ability to change any settings like sync settings and any settings on an individual user. Then we'll have a second line, which will be able to change some of the settings within a user's group and be able to reset their password or add them to different applications. There is a first-line service desk level set of users who will only have the ability to reset passwords, but if there's anything more complicated than that they'll pass it on. There are about three different levels of access that we currently have. There is level three and two access for not too difficult issues and then level one for password resets.

In the last place I worked, there were eight of us who took care of Azure AD which was for 90,000 people in Azure. There were people actively looking at the syncing engine, which does the sync between the two domains and there were four of us who managed that. We were called identity technical experts. So of a company of 90,000, we needed four of us, but that was only so that when people went on holiday, other people could still do the work. 

It's extensively used in that everybody has an account in Azure AD. I'm guessing we don't use all the features that are available. We still have our own mailboxes on-premise rather than in Azure. I would think that would be something in the future that they would look to move some or all of our mailboxes into Azure. But we all have a presence in Azure, so we are using a lot of the features, but I believe there are still a lot more we could use. 

How are customer service and technical support?

Their support was excellent for the deployment. They were really good. It depends a little bit on who you get at the other end and the nature of your question, but with the Azure AD stuff, we got through to experts who were able to give us the right answer straight away. They were very good at that point.

Which solution did I use previously and why did I switch?

We didn't use any other cloud solution. That was the first one that we used in the cloud. There's an on-premise Active Directory which is an additional Microsoft Active Directory. And the whole point of Azure AD is that it does connect to that. We haven't used any other directory service apart from those. The on-prem version of Active Directory I've used for 20 years. I haven't used any other active directory service. I'm sure there are others, but these are the main ones.

It's a level of responsibility, which is being passed over to Microsoft, that we no longer have to deal with. Certainly, the companies I've worked with were very happy for those bits of the technology being looked after by someone else. And so we were just in charge of the data that's in there rather than all the other, not-so-interesting things like backup and such.

It's moving the responsibility of the not very exciting bits over to Microsoft and their very good SLA. You can just concentrate on the bits that you're interested in.

How was the initial setup?

The initial setup was pretty straightforward. The only complex thing is syncing your on-premise active directory into Azure AD. It's not overly complicated and they also give you very good support. It's not very difficult to set up.

The deployment took a couple of months in the end because we just wanted to do it at a pace that we were comfortable with. We did some initial tests on users. We synced them into Azure AD, made sure they could access what we thought they could access, and make sure they could still do the same job that they could do before. Then we synced across another set of test users, then a bigger test, and then eventually synced everybody else. We did it over the course of a month. Technically you could do it in less than a week, but we just wanted to be cautious and make sure that it worked as we expected.

In terms of the implementation strategy, we have two different Azure Active Directory setups. We have one in our development area, so we did the development area one first. We sure we worked out how to do the syncing correctly, making sure we can see all the attributes that were on the on-prem AD that were then turning up in Azure AD. And then once we did a development one and that worked as we expected, we then did the production one. We did it in a step-by-step approach. We did a small set of test users, a larger set of test users, and then the entire company. It was a phased approach.

What about the implementation team?

We did the deployment ourselves. We spoke directly to Microsoft when we had a couple of queries because we had an enterprise agreement with them so we can raise a number of support tickets. There were a couple of questions we had about certain features, but the actual setup and deployment of it we did ourselves.

What was our ROI?

We've certainly seen returns on investment in terms of some of the security features around Azure. We've seen threats that have been detected much earlier. Previously, threat detection and that sort of thing was more of a response rather than doing anything preemptive. Something would happen and we'd then fix it. Whereas now in Azure AD, we've seen recommendations and those sort of things coming through from Microsoft saying, "You've got these accounts, these have all got weak passwords. We recommend getting these changed for end-users before they get hacked." We saw a marked decrease in the number of attacks and breaches against our credentials when we introduced multi-factor authentication for the entire company.

Had anybody, for whatever reason, passed on or shared their username or password, those could then be used to get into our services. Now with multi-factor authentication, we've seen a marked decrease in the number of threats we've seen come through. So there are some marked benefits of the security features.

SSPR, self-service password reset has also realized ROI for us. In the past, 60 to 70% of the calls coming into our help desk guys were for password resets. A large chunk, 50 to 60% of those are gone because people can just go to the URL we've shared with them and reset their password themselves without having to phone us, which means that our service desk guys can deal with real issues rather than just somebody to put on their password. So we saw a large decrease in password resets. We're still trying to get rid of even more of those, trying to make their job even easier, but we've seen a large reduction in the number of password request changes to our service desk.

What's my experience with pricing, setup cost, and licensing?

There are various levels of licenses. There are things called E3 and E5 licenses. E5 licenses come with more features but aren't required for some of the kinds of users who are just using email and Office. They only need an E3 license.

Pricing depends on the size of your organization and the deal you get with Microsoft. If you're a public sector, rather than a private sector, you get a good deal. Academic sectors get very good deals. The vast majority of our users use E5. But we're a Microsoft partner who resells their product so we get favorable rates because of that.

They have various pricing levels and the higher level you buy, the more features you get within Azure. The basic one is perfectly good for most customers. The more advanced and greater security features come with the higher pricing. And so customers who require that like military, banking, government or something are willing to pay that. The private sector generally pays more than the public sector. I know some colleagues who work in the academic sector get extremely good deals because Microsoft is very keen to have academic institutions on board. If you're working in academia or you work in the public sector, you will get a much better deal than you would in the private sector, but that's just business.

An E5 or E3 license is on a per-user basis. So the number of users you sync into Azure AD is the number of licenses you need to report that is going to be consumed by the end-users. It's a per-user per-year license.

The only other cost you get with Microsoft over and above the license cost of using Azure is the cost of using their operating system and software. So if you use Windows, then you can pay for your Windows licenses again through Azure. And if you use Office, meaning Excel, Word, and all that other stuff, you can pay an extra bit and they'll get a 365 license for the entire suite of offices.

If you're buying an E5 Office plus Windows, then you'll get a greater discount than if you were buying those separately. Microsoft will charge you for what you actually use. So if you've got a user who isn't using Office, or isn't using Windows for whatever reason, but they are consuming services within Azure, then you just give them an Azure license. Microsoft will split up and you buy a license based on what you actually use.

Which other solutions did I evaluate?

There are a couple of other options. There's obviously Amazon AWS and there's now Google GCP. I'm not sure either of those particular cloud providers had a particularly enterprise-level directory service. At the point when we migrated our users to Azure, I believe Azure was the only one that was an enterprise standard. Whilst the other ones have options, they weren't really suitable for the size of enterprise that we were running. 

What other advice do I have?

My advice would be to talk to Microsoft or a partner of Microsoft who will deploy it for you. You can do it yourself, it is absolutely possible but seek advice. Because the more users you sync into Azure, the more you have to pay for their licenses and not everybody has to be using Azure. Sync only accounts you need to, but in all cases, I would seek advice from a Microsoft partner or Microsoft themselves. They'll be able to talk through what you actually need, what you require, and then the best way to implement that. Whether that's syncing your entire user base or whether that's syncing a small subset of them because they're the only ones that are going to consume the services required.

I have learned two main lessons from using Azure AD. First, the introduction of multi-factor authentication. It was such a marked difference in the number of security incidents we had. There was such a reduction. If you have Azure AD, switch on multi-factor authentication, not just for the admin accounts and the highly privileged accounts that can access all the bits, but switch it on for everybody. It is a pain initially, while people get themselves set up. But once it's done the number of incidents you have relating to people losing their credentials is markedly reduced. It's a massive win.

I would rate it a nine out of ten. There are some things they can improve on, but those improvements are pretty small beans compared to what they've done.

Which deployment model are you using for this solution?

Hybrid Cloud
Disclosure: My company has a business relationship with this vendor other than being a customer.
PeerSpot user
Buyer's Guide
Download our free Microsoft Entra ID Report and get advice and tips from experienced pros sharing their opinions.
Updated: June 2025
Buyer's Guide
Download our free Microsoft Entra ID Report and get advice and tips from experienced pros sharing their opinions.