Can we get rid of on-premises Active Directory and go cloud-only with Entra ID?

Key facts

• The blocker is rarely users; it is apps, file shares, printers and devices that still expect a domain.
• Devices must move from domain joined or hybrid joined to Entra joined, normally by reset and Autopilot.
• Entra Kerberos and Azure Files can replace many on-premises file share needs.
• Legacy apps that need LDAP or Kerberos can stay behind Entra Private Access or Application Proxy, or on a small managed domain.
• Sync stays on until the last dependency is gone; then accounts become cloud-managed.

What Active Directory still does for you

Before planning a retirement, list everything that authenticates against or reads from Active Directory. In most environments the list is longer than expected.

Typical dependencies include domain joined PCs, Group Policy, file servers with NTFS permissions, line-of-business apps using Windows authentication or LDAP, print servers, Wi-Fi and VPN using RADIUS with AD groups, scanners and copiers sending to LDAP address books, SQL servers, service accounts, and Entra Connect itself.

• Devices and Group Policy
• File shares and NTFS permissions
• Apps using Kerberos, NTLM or LDAP
• Network access: Wi-Fi, VPN, RADIUS
• Printers, scanners and multifunction devices
• Service accounts and scheduled tasks
• Exchange hybrid attributes, if Exchange was ever on premises

Cloud replacements for each dependency

A phased plan

The safest order moves the things users touch daily first, so the domain becomes less important each month.

• Phase 1, inventory: domain controllers' logs, DNS, GPOs, service accounts, LDAP binds and SPNs reveal what is really in use.
• Phase 2, identity hygiene: clean up stale accounts, confirm UPNs match email, enable password hash sync, and roll out MFA and passwordless methods.
• Phase 3, devices: new and reset devices go Entra joined through Autopilot; Group Policy settings are rebuilt in Intune.
• Phase 4, data and apps: file shares move to SharePoint or Azure Files; apps move to modern authentication or are published through Private Access.
• Phase 5, accounts: once nothing needs the domain, convert accounts to cloud-managed, stop sync, and decommission domain controllers after a quiet period.

Converting synced accounts to cloud-managed

Users synced from AD are mastered on premises, so their core attributes cannot be edited in Entra ID. Microsoft has introduced ways to switch the source of authority for synced users and groups to the cloud, object by object, which avoids deleting and recreating accounts. Check the current support status and limits before planning around it.

The traditional method is to stop sync for the tenant, which converts all synced objects to cloud-managed at once. That is simple but final, and should only happen when the domain truly has no remaining role.

When to keep a small domain

Some organizations are not ready to go fully cloud-only, and that is fine. A manufacturing line controller, an ERP that only speaks LDAP, or a regulated system with long vendor cycles can justify keeping a minimal domain. The goal then is to shrink it: fewer servers, fewer accounts, no user PCs on it, and clear ownership.

How Accred Consulting approaches it

Accred Consulting runs discovery against your domain first: logon events, LDAP binds, GPOs, file shares, service accounts and device join state. The proposal lists every dependency with its replacement, the phases, a fixed price and a timeline. Our US-based specialists then move devices to Entra join with Autopilot and Intune, rebuild policy, move shares and apps, and handle the source-of-authority change when the last dependency is gone. You get documentation of the end-state design and knowledge transfer for your team, with optional support while the remaining domain controllers are retired.

Track record: 475+ client projects, 2,000+ migration workstreams and 210,000+ users migrated by a US-based team. Company facts · Case studies

Related questions