Curriculum Overview: Directory Services in Microsoft Azure

This curriculum provides a structured pathway to mastering identity and directory services within the Microsoft Azure ecosystem, specifically focusing on Microsoft Entra ID (formerly Azure Active Directory) and Microsoft Entra Domain Services (formerly Azure AD DS).

Prerequisites

Before beginning this module, learners should ideally possess the following foundational knowledge:

• Cloud Fundamentals: Understanding of IaaS, PaaS, and SaaS models.
• On-premises Networking: General familiarity with Windows Server and Active Directory Domain Services (AD DS).
• Identity Basics: Conceptual understanding of usernames, passwords, and permissions.
• Azure Subscription: Access to an Azure environment to view the Entra ID portal.

Module Breakdown

Learning Objectives per Module

Module 1: Foundations of Microsoft Entra ID

• Define Microsoft Entra ID as a cloud-based identity and access management service.
• Explain the role of Single Sign-On (SSO) and Multi-Factor Authentication (MFA) in cloud security.
• Differentiate between internal users, guest users, and external collaborators.

Module 2: Microsoft Entra Domain Services

• Describe the purpose of a Managed Domain where Microsoft handles Domain Controller (DC) maintenance.
• Identify legacy protocol support including Kerberos, NTLM, and LDAP.
• Explain the architecture of a replica set (the two managed DCs provided by Azure).

Module 3: Hybrid Identity & Synchronization

• Explain how Microsoft Entra Connect synchronizes on-premises AD objects to the cloud.
• Describe the flow of identity data from local data centers to Azure.

Module 4: Use Cases

• Identify when to use Entra ID (Modern Apps) vs. Entra Domain Services (Legacy Apps).
• Evaluate "Lift-and-Shift" scenarios for migrating virtual machines that require domain-join capabilities.

Architecture Visualization

Understanding the relationship between these services is critical for architectural success.

[!NOTE] Microsoft Entra Domain Services is not a complete replacement for on-premises AD in every scenario; it is a managed service designed to bridge the gap for applications that cannot yet use modern cloud authentication.

Success Metrics

To demonstrate mastery of this curriculum, the learner must be able to:

1. Categorize Services: Correctly identify whether an application requires Entra ID or Entra Domain Services based on its authentication protocol.
2. Architect Redundancy: Explain why Microsoft deploys two Domain Controllers (a replica set) in a managed domain.
3. Explain Synchronization: Describe how a user account created on-premises appears in the Azure portal.
4. Security Literacy: Define the "Zero Trust" implications of using managed directory services versus traditional domain controllers.

Real-World Application

In a professional environment, these skills are applied in the following ways:

• Legacy Migration: A company wants to move a 10-year-old accounting software to Azure. The software requires a domain-joined server. You would implement Microsoft Entra Domain Services to support this without managing the underlying OS of the domain controllers.
• Security Hardening: Implementing Conditional Access and MFA via Entra ID to protect corporate resources from unauthorized access.
• Cost Management: Reducing administrative overhead by offloading DC patching, backups, and encryption to Microsoft via managed services.

Managed Domain Infrastructure

The following diagram illustrates the managed nature of the replica sets within an Azure Virtual Network.

\begin{tikzpicture}[node distance=2cm, font=\small] \draw[thick, dashed] (0,0) rectangle (6,4) node[pos=0.1, above] {Azure Virtual Network}; \draw[fill=blue!10] (1,1) rectangle (2.5,3) node[midway, align=center] {Managed DC 1$Replica)}; \draw[fill=blue!10] (3.5,1) rectangle (5,3) node[midway, align=center] {Managed DC 2$Replica)}; \draw[<->, thick] (2.5,2) -- (3.5,2) node[midway, above] {Sync}; \node[draw, fill=green!10, rounded corners] at (3, -1) {Microsoft Managed (Patching/Backups)}; \draw[->] (3,-0.7) -- (3,0); \end{tikzpicture}

[!IMPORTANT] Remember: In Entra Domain Services, you have Administrative permissions to the domain, but you do NOT have Domain Admin or Enterprise Admin rights to the underlying forest, as Microsoft manages the infrastructure layer.