Active Directory & Entra ID — Complete Guide

In this tutorial, you'll learn about Active Directory & Entra ID. We cover key concepts, practical examples, and best practices to help you understand and apply this topic effectively.

Active Directory (AD) is Microsoft's directory service for on-premises Windows networks, while Microsoft Entra ID (formerly Azure AD) is its cloud-based successor — both provide identity management, authentication, and authorization for users and devices.

What You'll Learn

You'll understand Active Directory fundamentals — domains, forests, OUs, LDAP, Group Policy — and how Microsoft Entra ID extends identity to the cloud with SSO, conditional access, and hybrid identity.

Why Active Directory Matters

Over 90% of Fortune 500 companies use Active Directory. It's the backbone of enterprise identity — managing user access, enforcing security policies, and enabling single sign-on. DodaTech uses Entra ID for Doda Browser cloud sync, SSO across tools, and device Compliance policies.

Real-World Use

An employee joins a company. IT creates their AD user account once. This single account grants access to Windows login, email (Exchange Online), file servers, VPN, and cloud apps (Salesforce, Slack) — all without separate passwords.

AD & Entra ID Learning Path

flowchart LR
  A["Windows Networking"] --> B["Active Directory Domain Services"]
  B --> C["Group Policy & OU Design"]
  C --> D["Entra ID / Azure AD"]
  D --> E["Hybrid Identity"]
  E --> F["Conditional Access & Security"]
  D:::current
  classDef current fill:#f90,color:#fff,stroke:#333,stroke-width:2px

Active Directory vs Entra ID

Core Active Directory Concepts

1. Components

2. Common PowerShell Commands

# Query AD users
Get-ADUser -Filter {Enabled -eq $true} -Properties LastLogonDate |
    Select-Object Name, SamAccountName, LastLogonDate

# Create a new OU
New-ADOrganizationalUnit -Name "SecurityTeam" -Path "DC=dodatech,DC=local"

# Add a user to a security group
Add-ADGroupMember -Identity "Domain Admins" -Members "jsmith"

# Find all disabled accounts (inactive security risk)
Search-ADAccount -AccountDisabled -UsersOnly | Select-Object Name, ObjectClass

3. LDAP Query Example

using System.DirectoryServices;

var entry = new DirectoryEntry("LDAP://DC=dodatech,DC=local");
var searcher = new DirectorySearcher(entry)
{
    Filter = "(&(objectClass=user)(userAccountControl=512))", // Enabled users
    PageSize = 1000
};

var results = searcher.FindAll();
foreach (SearchResult result in results)
{
    var name = result.Properties["sAMAccountName"][0];
    Console.WriteLine($"User: {name}");
}

Microsoft Entra ID (formerly Azure AD)

Creating an Entra ID App Registration

# Register an application in Entra ID
Connect-MgGraph -Scopes "Application.ReadWrite.All"

$app = New-MgApplication `
    -DisplayName "DodaTech Security Scanner" `
    -SignInAudience "AzureADMyOrg" `
    -Web @{ RedirectUris = @("https://scanner.dodatech.com/auth/callback") }

# Create a client secret
$secret = Add-MgApplicationPassword -ApplicationId $app.Id

Write-Host "Client ID: $($app.AppId)"
Write-Host "Client Secret: $($secret.SecretText)" -ForegroundColor Yellow

Conditional Access Policy Example

A policy requiring MFA for all admin roles:

{
  "displayName": "Require MFA for Admins",
  "conditions": {
    "users": {
      "includeRoles": ["Global Administrator", "Security Administrator"]
    },
    "applications": {
      "includeApplications": ["All"]
    }
  },
  "grantControls": {
    "builtInControls": ["mfa"],
    "operator": "OR"
  }
}

Hybrid Identity: Connecting On-Prem AD to Entra ID

Use Azure AD Connect (or the newer Microsoft Entra Connect Sync) to synchronize on-premises AD users to Entra ID.

flowchart LR
  A["On-Prem AD\nDomain Controller"] -->|Azure AD Connect Sync| B["Microsoft Entra ID"]
  B --> C["SaaS Apps\nOffice 365, Salesforce"]
  B --> D["Azure Resources"]
  A --> E["On-Prem Apps\nFile Servers, Printers"]

Key decisions:

Security Best Practices

Common Errors

1. Access denied: LDAP bind failed: The service account used for LDAP queries lacks permissions. Grant Read access at the domain level or use a Domain Admin account.

2. Azure AD Connect sync errors — duplicate UPN: Two on-prem users have the same userPrincipalName. Fix by updating one user's UPN to be unique.

3. Time skew between DC and client: Kerberos requires time within 5 minutes between client and domain controller. Sync time with w32tm /resync.

4. Password writeback not working: The user is not in the correct OU scope. Ensure the user's OU is included in the Azure AD Connect sync scope for password writeback.

5. 401 — Invalid token from Entra ID app: The application's client secret expired or the token is for the wrong tenant. Rotate the secret and ensure the tenant claim in the token matches.

6. GPO not applying: The user or computer is in an OU where no GPO is linked, or loopback processing is misconfigured. Use gpresult /h report.html to diagnose.

7. SID history mismatch during migration: When migrating users between domains, the source SID must be in SIDHistory. This can cause access issues if not properly configured.

Practice Questions

1. What is the difference between Active Directory and Entra ID?
2. What protocol does AD use for authentication?
3. What is an Organizational Unit (OU)?
4. What is Azure AD Connect used for?
5. What is Conditional Access in Entra ID?

Answers:

1. AD is on-premises (LDAP/Kerberos), Entra ID is cloud (OAuth/Openid Connect). Entra ID also manages SaaS app SSO and device management.
2. Kerberos is the primary authentication protocol in Active Directory. LDAP is used for directory queries.
3. An OU is a container within a domain used to organize users, groups, and computers for applying Group Policies.
4. Azure AD Connect synchronizes users, groups, and passwords from on-prem AD to Entra ID for hybrid identity.
5. Conditional Access is an Entra ID feature that enforces access policies based on conditions (user, location, device, risk) — e.g., "require MFA when accessing from outside the office."

Challenge

Design a hybrid identity architecture for a company acquiring another company. The acquiring company uses on-prem AD (dodatech.local), the acquired company uses Entra ID. Plan the synchronization, domain trust, and migration strategy with zero downtime. Include OU structure, Group Policy plan, and conditional access policies.

Real-World Task

Configure an Entra ID Conditional Access policy that: (1) blocks all access from countries where the company does not operate, (2) requires MFA for all guest users, (3) requires compliant device (Intune) for access to email, and (4) sends alert emails to the SOC team for high-risk sign-ins.

Featured Snippet

What is Active Directory?

Active Directory (AD) is Microsoft's on-premises directory service that stores user accounts, computer accounts, and group policies, enabling centralized authentication (Kerberos) and authorization across a Windows domain network.

FAQ

Try It Yourself

What's Next