Moving legacy apps from AD DS to Entra DS

Question

Moving legacy apps from AD DS to Entra DS

Bojan Zivkovic 606

Hi, we have hybrid environment with 700-ish Hybrid Entra Joined Windows 11 devices and 80-ish servers joined to on-premises AD DS domain. Idea is to get rid of on-premises domain and all on-premises servers altogether but there are some legacy apps that still use "on-premises" protocols. Having decommissioned on-premises domain, our Windows 11 devices would be Entra Joined only and servers running these legacy apps would be replaced by servers (Azure VMs) joined to new Entra DS managed domain. Windows 11 devices would be now managed by Intune only (currently we have MCM-Intune co-management) whereas servers would be now managed by Azure tools in combination with some features provided by Entra DS such as GPOs.

In this scenario, to continue using those legacy apps (now hosted on servers in Azure) from Entra Joined Windows 11 devices (SSO using Entra user account) what would be all configuration steps we would need to perform (I have no practical experience with Entra DS whatsoever hence this question)? Practically, the same end user experience as they have now is something I am interested in. I do not have insight into those legacy applications details though.

Deepthi R 25 Reputation points Microsoft External Staff Moderator

2025-06-05T16:42:22.5166667+00:00

Hi Bojan Zivkovic

I would like to follow up to see if you have reached any solution, if not please let us know more details so that we can help
Deepthi R 25 Reputation points Microsoft External Staff Moderator

2025-06-06T12:17:29.4366667+00:00

Hi Bojan Zivkovic

I would like to follow up to see if you have reached any solution, if not please let us know more details so that we can help

3 answers

Your answer

Deepthi R 25 Reputation points Microsoft External Staff Moderator

2025-06-05T16:42:22.5166667+00:00

Hi Bojan Zivkovic

I would like to follow up to see if you have reached any solution, if not please let us know more details so that we can help
Deepthi R 25 Reputation points Microsoft External Staff Moderator

2025-06-06T12:17:29.4366667+00:00

Hi Bojan Zivkovic

I would like to follow up to see if you have reached any solution, if not please let us know more details so that we can help

Answer 1

Unfortunately, AFAIK, this wouldn't work. Entra DS does not support hybrid join, nor does it establish trust relationships with Entra ID. This causes a fundamental limitation in seamless authentication between Entra ID joined clients and Entra DS joined servers. Effectively, Entra ID joined Windows 11 devices cannot perform Kerberos authentication against Entra Domain Services (Entra DS) - because Entra DS does not trust Entra ID joined devices, and no machine accounts exist in Entra DS for those clients.

Btw. these limitations go away if you use AD DS running on Azure VMs - rather than Entra DS - which would also allow you to eliminate your on-premises environment.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Answer 2

Bojan Zivkovic 606

I was thinking the same way just wanted confirmation - syncing users from Entra ID to Entra DS is one thing but device part of the whole picture is something else which in this case is a showstopper.

Speaking of replacing on-premises DCs with DCs in Azure, that is on the cards as well, unfortunately total cost could be deciding factor here, and it seems that deploying Entra DS managed domain (single replica set) is cheaper but with many technical limitations if we want to completely decommission AD DS on-premises. People "pushing" Entra DS option should be aware of all limitations not thinking only about total cost.

Marcin Policht 50,735 Reputation points MVP Volunteer Moderator

2025-06-04T11:20:51.0466667+00:00

Not necessarily. Ultimately that depends on the size of your environment and its usage patterns, but, for the most part, a domain controller will perform well if NTDS.DIT can be fully cached in memory. Obviously there are other considerations (e.g. network throughput), but you don't need a very powerful VM to provide an acceptable performance. If you compare the cost of a couple of the VMs with https://azure.microsoft.com/en-us/pricing/details/microsoft-entra-ds/ , the differences is not likely to be significant. The primary distinction is the management overhead, which is minimized with Entra DS.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin
Bojan Zivkovic 606 Reputation points

2025-06-04T11:57:15.2533333+00:00

Everything depends on those legacy apps I know very little about - their components, type ... If moving those to Entra DS won't work, then nothing, I guess.

Answer 3

Marcin Policht 50,735 MVP Volunteer Moderator

Whatever works currently in your on-premises environment, should work the same way if you opt for using AD DS on Azure VMs from the authentication/authorization standpoint (obviously there are other considerations - such as support for broadcasts/multicast - but those go beyond what's discussed here).

The primary consideration is whether your management is willing to accept increased management overhead associated with using AD DS in Azure IaaS (vs Entra DS). However, note that this still is considerably lower comparing with maintaining AD DS on-premises.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Bojan Zivkovic 606 Reputation points

2025-06-04T12:17:37.9433333+00:00

Yes, but I think they might push for Entra DS, not keeping AD DS with only DCs in Azure option.
Marcin Policht 50,735 Reputation points MVP Volunteer Moderator

2025-06-04T13:21:45.5733333+00:00

As I stated earlier, this won't work with Entra ID joined Windows 11 devices

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin
Bojan Zivkovic 606 Reputation points

2025-06-04T14:31:58.2566667+00:00

Ok Marcin, how come legacy apps migrated to Entra DS can be accessed from Entra joined client devices anyways since that is typical use case scenario for Entra DS?
Marcin Policht 50,735 Reputation points MVP Volunteer Moderator

2025-06-04T14:56:46.75+00:00

I'm not aware of using Entra joined client devices being mentioned in any way as a typical use case for Entra DS

As per https://learn.microsoft.com/en-us/entra/identity/domain-services/overview

Microsoft Entra Domain Services provides managed domain services such as domain join, group policy, lightweight directory access protocol (LDAP), and Kerberos/NTLM authentication. You use these domain services without the need to deploy, manage, and patch domain controllers (DCs) in the cloud.

A Domain Services managed domain lets you run legacy applications in the cloud that can't use modern authentication methods, or where you don't want directory lookups to always go back to an on-premises AD DS environment. You can lift and shift those legacy applications from your on-premises environment into a managed domain, without needing to manage the AD DS environment in the cloud.

Domain Services integrates with your existing Microsoft Entra tenant. This integration lets users sign in to services and applications connected to the managed domain using their existing credentials. You can also use existing groups and user accounts to secure access to resources. These features provide a smoother lift-and-shift of on-premises resources to Azure.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Share via

Moving legacy apps from AD DS to Entra DS

3 answers

Your answer