Recommendations to migrate on-prem domain controllers to Microsoft Entra ID

Question

Hi everyone,

We are planning to migrate our on-premises domain controllers to Microsoft Entra ID and need guidance on the best approach.

Current Environment:

• Single forest with 5 domain controllers
• Microsoft Entra Connect syncing on-prem users to our tenant
• Federated authentication with ADFS

Looking for Help On:

1. Where to start? What are the first steps in planning this migration?
2. Architectural design – How should the new identity infrastructure look?
3. Reference architecture diagrams – Are there any official Microsoft or community diagrams that illustrate this migration?
4. Features that help during and after migration – What tools and capabilities (like Pass-Through Authentication, Password Hash Sync, etc.) should we consider?
5. Best practices – Any lessons learned from those who have completed this transition?Hi everyone, We are planning to migrate our on-premises domain controllers to Microsoft Entra ID and need guidance on the best approach. Current Environment:
   • Single forest with 5 domain controllers
   • Microsoft Entra Connect syncing on-prem users to our tenant
   • Federated authentication with ADFS
   Looking for Help On:
   1. Where to start? What are the first steps in planning this migration?
   2. Architectural design – How should the new identity infrastructure look?
   3. Reference architecture diagrams – Are there any official Microsoft or community diagrams that illustrate this migration?
   4. Features that help during and after migration – What tools and capabilities (like Pass-Through Authentication, Password Hash Sync, etc.) should we consider?
   5. Best practices – Any lessons learned from those who have completed this transition?

Thanks,

Answer 1

Hello Ahmed,

Are you looking to move completely to the cloud or do you want to do a hybrid identity configuration where users are synchronized between your on-premises domain and Entra ID?

Examine the dependencies, services, and applications that are dependent on domain controllers in your present on-premises Active Directory system. Think about topics like DNS, user authentication, Group Policy Objects (GPOs), legacy apps, and third-party services. Recognize your device and user identities, as well as if you require capabilities like password management, hybrid identity, or a smooth on-premises and cloud user experience.

Choosing whether to switch to a totally cloud-based identity architecture or retain certain on-premises components, like a hybrid arrangement with ADFS and MS Entra Connect, is the first step.

Migration-Best-Practices
Identity architecture design
Integrate on-premises Active Directory domains with Microsoft Entra ID

1st Option: Full Migration to Microsoft Entra ID (Cloud-Only Identity): In this model, your identities are entirely cloud-based, and you’ll move away from ADFS or any on-premises Active Directory. You will rely on Azure AD for authentication and management
Transition to the cloud
migrate-from-federation-to-cloud-authentication

2nd Option: Hybrid Identity Model with Azure AD Connect: This setup allows you to sync users, groups, and other Active Directory objects to Microsoft Entra ID while retaining some on-premises components for specific legacy scenarios or regulatory reasons.
Choose the right authentication method for your Microsoft Entra hybrid identity solution
Configure Microsoft Entra hybrid join
What is hybrid identity with Microsoft Entra ID?

Tools:
To sync your on-premises Active Directory with Entra ID, maintain using MS Entra Connect. Investigate features like Federation (for ongoing usage of ADFS or other federated systems), Pass-Through Authentication (for real-time user authentication), and Password Hash Sync (for smooth password synchronization).
Another option for a lighter cloud-based sync solution is Azure AD Connect Cloud Sync.

Best practices: Migrate users/devices in phases; start small, test first. Consider migrating groups of users and devices in phases. Start with a small group to test the process before scaling up. Backup identity data and have a recovery plan.

Monitor migration to prevent service disruption.

Inform users about changes and offer training on new login experiences (e.g., Azure AD Join, MFA).

Use Azure AD Connect Health and Microsoft Sentinel to monitor post-migration hybrid identity.

For a more in-depth understanding, consider watching this https://www.youtube.com/watch?v=L_K1qAwYGCE&t=85s

I hope this clarifies things.

Answer 2

First question to ask yourself: Do I need Kerberos authentication on my Azure virtual network? Can I fully eliminate my Domain Controllers? Entra ID can handle ALL authentication with modern auth technologies. But if you must use Kerberos, then there are other solutions. Ideally, you want to think about not supporting DCs anymore.