Prepare now for the eventual end of Microsoft Active Directory as it’s phased out in favor of the more secure, less risky Entra.
Artificial intelligence is top of mind for nearly everything Microsoft is doing these days, but there’s another goal the company would like to see its users strive to attain — one that may not be easily obtained — and that’s to be Entra-joined only.
That means no more Active Directory (AD) and no more traditional domain: instead, your devices join Entra (formerly Azure AD) natively and are integrated into Microsoft’s cloud-based directory service for centralized management, authentication, and security.
It’s a major shift from the hybrid-join setups many of us have relied upon in the past in which workstations connect to both Entra resources and the traditional Active Directory domain and others connect to an AD domain and online resources such as hosted email, SharePoint, and OneDrive resources.
Microsoft’s intention to have customers transition to an Entra-only join was revealed at its recent Ignite annual information technology professional conference, from which I always look to for indicators on the company’s future plans and how they will potentially impact me.
While the hybrid approach has been the go-to method for many for the last 10 years, it introduces more risk to a system. It’s inherently less secure, due to the requirement to have a domain trust that introduces well-known lateral movement paths for attackers.
In addition, you have the additional effort required to maintain Active Directory and Entra simultaneously, which can often trigger issues where legacy group policies compete with Intune policies. This in turn adds to the complexity of debugging why systems are doing x and you want them to do y.
Migrating systems to Entra only join will reinforce security
Relying on hybrid join also means allowing more complexity in your infrastructure. You need to keep track of domains, domain controllers, domain name servers, DHCP servers, and various technologies from firewalls to virtual private networks, all to ensure that your traditional domain merely functions. In addition, you’ll need to ensure that these assets are maintained, patched, and under active support.
This may also mean time and energy spent updating and maintaining server operating systems — layer on the need to migrate from Windows 10 and move to Windows 11 and you may need to do a lot of reassessment around how you apply technology resources in your firm.
Going forward with an Entra-only join ultimately will provide a simplified enrollment that can be deployed with merely an internet connection. This is especially convenient when you have a dispersed workforce — all you need to deploy a workstation is an internet connection and an Autopilot set up to connect to Entra ID.
Additional future features will come to Entra ID only, thus ensuring that going forward you are ready for future changes that Microsoft will ultimately bring to its cloud offerings.
But perhaps the most important security considerations are the use of Entra ID for authentication and identity management, compliance policy enforcement through tools like Microsoft Intune, single sign-on and the application of advanced security measures such as multifactor authentication (MFA).
How to make the switch to Entra-only
First, take inventory of your line of business applications and determine if they are beginning their own migration to either cloud versions of their Active Directory counterparts or if your current applications can actually work with an Entra ID joined workstation. You may find that there are key applications that still require a traditional network. Review the long-term plans of suppliers and vendors and build them into your own plans.
If your applications are more than 10 years old, the chances are very good that you will not be able to implement an Entra-only join and must stay with a hybrid arrangement. Older applications often do not have the necessary processes to use alternative authentication techniques and are still using more traditional authentication processes.
They don’t understand machine authentication and instead assume a more traditional Active Directory infrastructure and do not look for support to connect to cloud resources. I’ve personally seen too many applications still rely on older authentication techniques such as NTLM and have not made any move to be able to work with newer technologies.
Start building a list of applications that can be moved to a modern network and those that cannot. Reach out to these vendors now even if you have no immediate plans to go Entra-only.
Review whether there are existing methodologies that can provide you with the tools you need for your applications. For example, if your applications need a drive mapping in order to connect to workstations, this can be done with various methodologies that do not include group policy. Intune can be used to map drive letters using ADMX templates.
Review group policies
Next take the time to review and determine if all of your group policies are still valid and still effective. As you move to Intune, many of you may find that the group policies you still have in your Active Directory are no longer needed or valid in your network.
Export your group policy objects and review what they are doing. For many years, many of us have used custom group policies to set tweaks unique to the operating systems and Office suites we would have at the time.
But don’t throw out all of your practices that you are used to performing. For example, in traditional Active Directory you are used to rotating Kerberos keys on a regular basis. When you move to Entra ID there is a similar process. Just like with Active Directory, you’ll need to rotate the Kerberos keys as well. Performing this step will minimize stealing or impersonating Kerberos tickets.
You’ll need to rotate these keys using the following PowerShell command on a regular basis:
Set-AzureADKerberosServer -Domain $domain -CloudCredential $cloudCred -DomainCredential $domainCred -RotateServerKey
Moving to the cloud does not negate the need to perform processes to ensure that credentials are secure. Rotation of keys is mandatory in both on-premises as well as cloud resources.
Expect more Entra-only join features from Microsoft
Going forward, Microsoft is adding new features with an Entra-only viewpoint in mind. For example, recent releases of Autopilot work with the following requirements:
- Windows 11, version 23H2 with KB5035942 or later.
- Windows 11, version 22H2 with KB5035942 or later.
- Microsoft Entra ID: only Microsoft Entra join is supported.
You no longer need to be concerned about Autopilot support when you are Entra-join only.
Windows 11 22H2 devices that are Entra joined only are supported for web sign-in. As noted by Microsoft, these are the requirements:
- Windows 11, version 22H2 with 5030310, or later.
- Microsoft Entra joined.
- Internet connectivity, as authentication is done over the internet.
For web sign-in, a hybrid joined device or Active Directory device is not supported.
Active Directory is going to be phased out over a long period of time — take the time now to ensure you are planning for this in the long term and that you can pivot your firm’s resources to your needs.
