Entra ID vs on-prem Active Directory: retiring the domain controller

The file server moved to SharePoint 2 years ago. Email has been in Microsoft 365 for a decade. And yet there is still 1 machine humming in the closet, the domain controller, running Active Directory for 22 people who mostly sign in to cloud apps all day. It is 6 years old, the warranty lapsed and nobody wants to spend $12,000 replacing a server whose main job is letting people log in to their laptops.

This is the most common “last server” story we see, and the question behind it is worth answering carefully: can a small business retire Active Directory entirely and run identity from Entra ID? Increasingly, yes. But the details decide whether the migration is a clean 60-day project or a year of hybrid limbo.

What the domain controller still does

Active Directory has been the backbone of Windows networks since 2000, and it earned that position. Before deciding to retire it, list what it is actually doing for you today:

• Sign-in for Windows machines joined to the domain
• Group Policy, the settings engine pushing password rules, drive mappings, printer deployments and lockdown settings
• Authentication for anything on the local network that speaks Kerberos or LDAP, which can include the phone system, the copier’s scan-to-folder job, an aging line-of-business app or a warehouse label printer
• File share permissions, if any on-prem file storage remains

The first 2 have clean cloud replacements. The second 2 are where retirement projects go to die, so the honest first step is an inventory. In our experience the inventory turns up 1 or 2 forgotten LDAP dependencies in most offices, and finding them in week 1 beats finding them the morning after cutover.

What the cloud-native replacement looks like

A cloud-only Microsoft identity stack for a small business has 3 pieces, and if you are licensed for Microsoft 365 Business Premium you already own all of them:

• Entra ID becomes the directory. Users, groups and sign-in live in the same place your Microsoft 365 accounts already live. Laptops are “Entra joined” rather than domain joined, and people sign in with the same account they use for email.
• Intune replaces Group Policy. Password and encryption requirements, update rings, Wi-Fi profiles, printer deployment and app installs all move to Intune configuration profiles. It is not a 1-for-1 translation of every GPO, and that is usually a feature. Most domains carry 15 years of accumulated policy nobody can explain, and this is the forced spring cleaning.
• Windows Hello for Business replaces the password-at-the-keyboard habit. Sign-in becomes a PIN or fingerprint backed by hardware, which users genuinely prefer and which is far more phishing-resistant than a reusable password.

Add Conditional Access policies on top (require MFA, block legacy protocols, restrict risky sign-ins) and the small business ends up with an identity posture that is meaningfully stronger than what the old domain provided. This stack is also the foundation for the Zero Trust approach we have written about, where trust follows the user and device rather than the building.

What Entra ID does not do

Fairness requires the other column. Cloud-only identity has real gaps:

• No Kerberos or LDAP on the local network. The copier, the badge system or the 2009 line-of-business app that authenticates against the domain will not talk to Entra ID directly
• No Group Policy, so any process or vendor tool that assumes GPO needs rework
• Legacy on-prem apps that require a domain user context need either an upgrade, a SaaS replacement or a small footprint like Entra Domain Services, which reintroduces cost and complexity

This is why the dependency inventory decides the project. A company whose remaining on-prem needs are a copier and a label printer can almost always solve them with device-local accounts or vendor cloud features. A company running a domain-bound ERP cannot go cloud-only until the ERP question is answered, and that is really a server retirement question more than an identity question.

Hybrid is a bridge, not a destination

Microsoft’s official on-ramp is hybrid: keep AD, sync it to Entra ID with Entra Connect and let machines be joined to both. Nearly every company migrating from on-prem lives here for a while, and for a period it is the right place to be.

The trap is staying. Hybrid means running and securing both systems indefinitely: patching domain controllers, maintaining sync health and keeping 2 sets of identity controls coherent. Domain controllers are also a prime ransomware target, and a compromised AD can poison the synced cloud environment. For a 10 to 50 user company the steady state should be simpler than the starting state, not more complicated. Set a decommission date for the domain controller when the hybrid phase begins, or it will quietly become permanent.

Who can go cloud-only, and what it takes

Our rule of thumb for 10 to 50 user organizations:

• Strong candidates: cloud-hosted email and files, modern Windows 10 or 11 hardware, line-of-business apps that are SaaS or at least web-based, no on-prem servers beyond the DC. Most professional services firms and a lot of light-industrial front offices fit here.
• Plan first: 1 or 2 domain-bound apps or devices. Solve those, then proceed.
• Not yet: an on-prem ERP or production system with deep AD integration. Hybrid honestly, with a plan.

For the strong candidates, the realistic project shape is 30 to 90 days end to end: a week or 2 of inventory and Intune policy build, a pilot group of 3 to 5 users, then rolling cutover of machines (Entra join is cleanest with a reset or a fresh device, so many companies time the migration to a hardware refresh cycle), and finally the satisfying part, powering off the domain controller. Budget-wise, you are trading a $10,000 to $15,000 server refresh plus ongoing care for licensing you likely already pay and a 1-time project effort.

We covered the broader question of consolidating identity in managed identity for the 50-person company. Retiring AD is often the biggest single step in that consolidation.

The decision, plainly

If your last server is a domain controller and your dependency list is short, retiring Active Directory is no longer the bleeding edge. It is the boring, well-trodden path, and it usually leaves a small business more secure, not less, because the modern controls (MFA everywhere, Conditional Access, device compliance) come built into the destination.

If the dependency list is not short, the answer is not “never,” it is “sequence.” Apps first, identity second.

Atticus Rowan plans and runs these migrations for small businesses across Ohio, from the dependency inventory through the day the closet finally goes quiet. If you are staring at a domain controller quote and wondering whether there is a better answer, talk to us before you buy the next server.