Glossary
Active Directory is Microsoft’s directory technology; Active Directory Domain Services manages identities and access relationships in Windows domains.
In most enterprise architecture discussions, “AD” refers to Active Directory Domain Services (AD DS). It stores directory objects and supports authentication for domain-connected resources. Its main design context is enterprise infrastructure, which differs from the needs of a public customer-registration journey.
AD DS runs on domain controllers that hold directory data and provide domain services. Objects represent entities such as users and computers. Groups can simplify permission assignments, while organizational units provide a structure for administration.
A domain groups objects and services under a directory namespace and administrative structure. Multiple domains can form a forest. Trust relationships can support access across domains, but the relationship does not make every resource available to every identity.
AD DS supports LDAP for directory access and Kerberos for authentication. Group Policy provides a way to manage settings for domain users and computers. These capabilities serve different purposes, so an application using LDAP is not necessarily using every feature of the domain environment.
Microsoft Entra ID, formerly Azure Active Directory, is a separate cloud identity service. The older naming can cause confusion: moving an application to Entra ID does not simply turn its existing AD DS domain controller into a cloud endpoint.
Organizations can connect AD DS and cloud identity systems through supported synchronization or federation arrangements. The integration needs decisions about which source owns each identity attribute and how changes propagate. An account disabled in one system may require additional handling to end sessions in another.
A company selling to business customers may allow a customer’s employees to use their organization’s sign-in. The customer-facing portal can accept a federation assertion from an identity provider connected to that organization’s directory, rather than requiring the portal to query the domain directly.
The portal still owns its customer account relationships and resource-level permissions. Knowing that a user authenticated through a corporate identity provider does not tell the portal which invoices that person may download.
Modernization work should therefore separate the directory dependency from the customer journey. Inventory applications that rely on specific groups or directory attributes before changing the authentication interface. That preserves necessary business relationships while allowing sign-in and recovery to evolve.
Privileged access to domain administration also needs protection. Changes to directory groups or identity records can affect many dependent services, making auditability and controlled delegation important operational requirements.
Is Active Directory the same as Microsoft Entra ID?
No. AD DS provides domain-based directory services. Microsoft Entra ID is a separate cloud identity service, although organizations can integrate the two.
Is LDAP another name for Active Directory?
No. LDAP is a directory access protocol supported by AD DS and other directory products. AD DS includes capabilities beyond that protocol.
Can a customer portal use identities from an AD environment?
Yes. One approach is federation through an identity provider connected to the directory. The portal must still enforce customer-organization membership and application permissions.
Related: Directory Consolidation · IAM vs. CIAM · Identity Federation · Legacy IdP Migration · B2B Identity Management · Role-Based Access Control (RBAC)
