Most of our core business applications are being migrated to SaaS, which would leave on-premises Active Directory and other Windows- and security-related infrastructure as the main services still running locally. Our organization spans 10 companies, each with roughly 1,000 employees, and many locations ranging from 10 to 100 employees. Each company has around 10–30 sites, and about 30% operate in similar industries.nnWould it be worthwhile to move identity and security capabilities to Microsoft Entra ID and Azure, even if little else is hosted there? I'm particularly interested in the benefits and drawbacks around cost, technology, scalability, operational efficiency, and real-world experience.nnIf the answer is yes, what would a sensible high-level architecture look like? For example, should we use a hybrid or cloud-only identity model, separate or shared tenants, and shared or dedicated networking and security components?
4 Answers
For the architecture, I would normally start with a carefully governed Entra tenant model rather than creating a separate tenant for every site. Whether the companies should share one tenant or use multiple tenants depends on legal separation, regulatory requirements, branding, and how independently they operate. Use federation or cross-tenant collaboration only where there is a clear need.nnFor connectivity, avoid designing a large network just because identity is moving to the cloud. SaaS access can often use direct internet connectivity with strong endpoint and identity controls. Keep dedicated private connectivity for workloads that genuinely require it, and treat administration, privileged access, logging, and recovery as first-class design concerns.
The biggest gains are generally operational rather than simply infrastructure cost savings. Centralized SSO reduces password and support overhead, Conditional Access can enforce requirements based on device, location, application, and risk, and cloud identity services scale more easily across sites than maintaining controllers and security tooling everywhere.nnHowever, licensing, migration work, identity cleanup, tenant governance, and staff training can be substantial. Build a business case around reduced administration and improved risk reduction rather than assuming the cloud will automatically be cheaper.
For a SaaS-heavy environment, Entra ID is usually worth adopting even if you do not run many workloads in Azure. Identity becomes a major security boundary once applications are accessed over the internet, so features such as single sign-on, multifactor authentication, Conditional Access, Privileged Identity Management, and identity-risk detection can provide significant value.nnIt also works with applications and services outside the Microsoft ecosystem, so you are not limited to Microsoft-hosted workloads. The main benefits are stronger centralized controls, easier onboarding and offboarding, and less duplicated authentication management across companies and SaaS providers.
This does not have to be an all-or-nothing migration. A hybrid design is often the practical starting point: keep on-premises Active Directory for systems that still need it, synchronize identities to Entra ID, and use Entra for SaaS access and modern security policies. That lets you retain existing Group Policy and legacy application compatibility while gradually reducing dependence on local infrastructure.
Keep in mind that Intune policies are not a one-for-one replacement for traditional Group Policy, especially where complex OU-based administration is involved. Inventory those dependencies before deciding what can be retired.