Do you still need Active Directory?

For twenty-plus years, the default answer for any office with more than a handful of computers was Active Directory: a Windows server in the closet that held every user account, enforced the password rules, and decided who could open which folder. A lot of businesses are still running that server, paying to maintain it, and quietly wondering if they still need it. Sometimes the answer is yes. Increasingly, it is no. Here is how to tell which one you are.

What Active Directory actually does

On-prem Active Directory (AD) gives you three big things. Central logins: one account per person that works on any domain-joined computer, so the front desk PC and the back office PC both know who Sarah is. Group Policy (GPO): rules pushed to every machine, like screen-lock timeouts, mapped drives, printer assignments, and software restrictions. And permissions on file shares: the accounting folder opens for accounting and nobody else, enforced by the server.

The cost side: a physical or virtual Windows Server, Windows Server licensing, client access licenses, patching, backups, and someone who knows how to care for it. For a 50-person company with a file server and strict controls, that is money well spent. For a 6-person office, it is often a $5,000 habit nobody has questioned.

The cloud option: Entra ID

Microsoft Entra ID (the product formerly called Azure Active Directory) is the cloud descendant. If your business uses Microsoft 365, you already have it: every M365 user account is an Entra ID account. Windows machines can be joined to Entra ID instead of a local domain, which gets you central logins, the ability to disable a departed employee's access from a web portal, and multi-factor authentication across email, files, and apps.

What Entra ID alone does not give you is Group Policy. The cloud equivalent is Microsoft Intune, which pushes settings, security baselines, and software to machines over the internet. Intune covers most of what small businesses actually used GPO for, and it works on laptops that never set foot in the office, which GPO handles poorly. Entra ID and Intune come bundled in Microsoft 365 Business Premium, which runs in the low tens of dollars per user per month and includes the Office apps you are probably already paying for.

When on-prem AD still wins

Domain-joined, server-in-the-building AD is still the right call in a few situations:

• You genuinely need a file server. Large CAD files, video, big databases, or software that demands a mapped drive on the local network. AD and a Windows file server remain the cleanest way to run per-folder permissions on premises.
• Line-of-business software requires it. Plenty of industry apps, especially in manufacturing, healthcare, and legal, still expect a domain. Check with the vendor before you plan a funeral for the server.
• You need deep GPO control. Intune has closed most of the gap, but if you have years of intricate policies, shared workstations in a shop environment, or machines that cannot reach the internet, GPO is still more precise.
• Compliance says so. Some frameworks and auditors are written around domain controls. Not a reason to keep AD forever, but a reason to plan the exit carefully.

There is also a middle path called hybrid: keep AD on site and sync it to Entra ID with Microsoft's Entra Connect tool, so the same account works on the local domain and in Microsoft 365. Lots of businesses live here during a transition. Fewer should live here permanently, because now you are maintaining both.

The small-office cloud-only path

Here is the setup we deploy for most offices under about 25 people that do not have a hard on-prem requirement:

• Microsoft 365 Business Premium for every user.
• Every computer joined to Entra ID at setup, so people sign in with their work account and MFA protects it.
• Intune enforcing the basics: disk encryption, screen lock, antivirus settings, updates.
• Files in SharePoint and OneDrive instead of a file server. Permissions by team, files available anywhere, versioning built in.
• No Windows Server. No server to patch, back up, or replace in five years.

When someone leaves, you disable one account from a browser and their laptop, email, and files all lock at once. That single motion is worth the migration by itself. And the old server, if it is only serving files, either retires completely or gets replaced by a NAS for the one big shared folder that does not fit the cloud model.

How to know you got it right

Whichever way you land, the test is the same. Pick a fake departing employee and time how long it takes to cut off all their access; the answer should be minutes, from one place. Check that every computer requires a company-controlled login rather than a local account someone set up in 2019. Confirm files have permissions by group, not shared passwords. If you are cloud-only, confirm nothing in the office still points at the old domain. And if the server is staying, make sure it is patched, backed up, and on hardware younger than your last two phones. A domain controller from 2016 with no backups is not an IT strategy, it is a countdown.