We operate two air-gapped networks for security and contractual reasons, with separate on-premises domains connected to different Microsoft 365 tenants. For one environment, we want to move toward cloud-managed devices using Windows Autopilot and Azure Virtual Desktop for selected user groups. Some existing virtual machines will be retired or replaced with SaaS, but a small number of servers will remain on premises.
These servers are on the same side as the users moving to cloud-only devices, and their applications do not necessarily require Active Directory authentication. Is there still a good reason to maintain a traditional Active Directory domain just to manage a handful of on-premises servers? How are others handling similar setups—using an existing domain, workgroups, Entra Domain Services, VPN-based management, or another approach?
3 Answers
If the main goal is to remove the on-premises domain while still supporting services that need LDAP or domain-style features, Microsoft Entra Domain Services may be worth evaluating. It can provide managed domain services for Entra identities without maintaining your own domain controllers, though it will not replace every traditional Active Directory capability.
A workgroup is not really a centralized management solution. Each machine maintains its own local accounts, permissions, and security settings, so it becomes awkward and risky once you have more than a very small number of servers. If these systems need consistent administration, a domain or another centralized management platform is usually preferable.
Cloud-only endpoints can still access on-premises services while the existing domain remains in place. If users are synchronized from Active Directory, features such as Kerberos cloud trust can help with access to resources like file and print services without requiring the endpoints to be traditionally joined in the same way.
For only a few servers, keeping a small, isolated AD environment may be simpler and cheaper than moving Windows workloads directly into Azure. Focus on single sign-on where possible, and consider cloud-managed or Entra-based alternatives only after checking the authentication and management requirements of each application.
That suggests keeping a VPN path back to the on-premises network and retaining Active Directory to manage the servers centrally, even if the user devices themselves are cloud-only.