We have two air-gapped networks for contractual and security requirements, with separate on-premises domains connected to different Microsoft 365 tenants. For one environment, we want to move toward cloud-managed devices using Autopilot and Azure Virtual Desktop for certain user groups. Some existing virtual machines will be retired or replaced by SaaS, but a small number of servers and applications will remain on-premises. These services do not necessarily require Active Directory authentication. For a setup like this, is it still worth maintaining a small on-premises Active Directory domain, or is there a better approach? How are others managing on-premises servers when endpoint devices are cloud-only—using a domain, workgroups, Entra Domain Services, VPN access, or another solution?
4 Answers
A workgroup is not really centralized management; every server maintains its own users, permissions, and security settings. For more than a very small and static environment, keeping a minimal Active Directory domain is usually easier to administer. You could provide controlled VPN access back to the on-premises network and manage the servers centrally through that domain.
If the goal is to remove traditional Active Directory while supporting applications that still need LDAP or domain-style features, Entra Domain Services could be an option. It can provide managed domain services tied to Entra identities without maintaining domain controllers yourself. It is worth checking each application’s authentication and management requirements first.
Cloud-managed endpoints can still access on-premises file and print services while traditional AD remains in place. With the right Entra integration, including Kerberos cloud trust where supported, users can authenticate without the devices being fully domain-joined. For services that do not need AD authentication, use local service identities or the application’s own identity system and protect access through network controls and SSO where possible.
I would not move a few Windows VMs to Azure solely to make the environment look cloud-based; the licensing and compute costs can become disproportionate. Retaining a small on-premises footprint may be cheaper. Cloud-hosting selected Linux workloads or web applications can make more financial sense, while the remaining servers are managed through a minimal domain or another centralized management platform.
That makes sense. A VPN back to the on-premises network with a small domain may be the simplest way to keep centralized administration.