Active Directory to Entra ID Migration Services

The Forced March to Cloud Identity

Microsoft is systematically retiring on-premises dependencies, which sets much of your migration timeline:

• 31 March 2026 (passed): Microsoft scheduled Entra ID to stop supporting app authentication without a service principal in the tenant, per its service principal announcement and mitigation guide. Check your service principal sign-in logs for apps that still authenticate without one.
• 28 April 2026 (passed): Azure Application Gateway V1, including WAF v1, retired. This is a gateway retirement, not an NTLM deadline; Microsoft says remaining V1 resources can be blocked and deleted, so confirm any gateway in front of internal apps is on V2.
• Next major Windows Server release (no date announced): Microsoft's NTLM roadmap (29 January 2026) plans to disable network NTLM by default in that release and the associated Windows client releases, with new Kerberos fallbacks (IAKerb and Local KDC) planned for the second half of 2026 on Windows Server 2025 and Windows 11 24H2 and later. Microsoft says timelines are subject to change, and NTLM can be re-enabled by policy.
• Ongoing: Azure AD Connect V1.x already dead (October 2023). V2.x is "supported" but Cloud Sync is the future.

Staying on hybrid identity indefinitely gets harder as Microsoft changes defaults and retires older components.

The reality: While exact figures vary by source, the majority of enterprises still run on-premises Active Directory infrastructure, but Microsoft's licensing model now penalizes hybrid deployments. Entra ID P2 is $9/user/month. Maintaining on-prem AD Domain Controllers costs ~$180K/year (hardware, power/cooling, Windows Server licensing, SQL licensing for Azure AD Connect, admin overhead).

Go / No-Go Assessment

Before committing to Entra ID migration, assess your readiness.

Top 3 Failure Modes

5 Technical Traps: Active Directory to Entra ID

1. Group Policy Preferences ≠ Intune Settings Catalog

The Problem: GPPs (drive mappings, scheduled tasks, printer deployments) have no Intune equivalent.

• Win: Drive mappings work via AD domain membership.
• Fail: Entra ID-joined devices don't see domain shares without explicit Azure File Share integration.
• Solution: Use Intune Proactive Remediations (PowerShell scripts) to map drives, or migrate file shares to SharePoint/OneDrive.

2. Nested Groups & Dynamic Membership

The Problem: Entra ID supports nested groups but with performance penalties. Dynamic groups behave differently.

• AD Behavior: Nested groups inherit permissions instantly via SID expansion.
• Entra ID Behavior: Nested group membership evaluation happens asynchronously. Processing delays can range from a few minutes to potentially longer for large, complex group structures.
• Solution: Flatten group structures where possible. Use Entra ID dynamic groups with attribute-based membership rules.

3. Kerberos vs. Modern Auth

The Problem: Legacy apps expect Kerberos (Windows Integrated Auth). Entra ID uses OAuth 2.0/OIDC.

• Temporary Fix: Use Microsoft Entra Kerberos (cloud-based KDC) for hybrid-joined devices. Requires Windows Hello for Business.
• Long-Term Fix: Refactor apps to use modern auth (MSAL libraries, OAuth 2.0). This requires developer effort.

4. Device Trust Models

The Problem: On-prem AD uses domain join for device trust. Entra ID offers three models:

• Entra ID Joined (cloud-only): Best for new devices, no on-prem access.
• Hybrid Entra ID Joined: Devices trust both AD and Entra ID. Transitional model.
• Entra ID Registered: BYOD devices, limited trust.
• Solution: Hybrid join buys you time but adds complexity. Plan phased migration to pure Entra ID join.

5. Password Hash Sync vs. Pass-Through Auth vs. Federation

The Problem: Choosing the wrong auth method creates security gaps or user friction.

• Password Hash Sync (PHS): Simplest. Hashes synced to cloud. Risk: Cloud breach exposes hashes.
• Pass-Through Auth (PTA): On-prem validation. Risk: Requires on-prem agents, defeats cloud-only goal.
• Federation (ADFS): Most complex. Risk: ADFS is a breach vector (SolarWinds taught us this).
• Best Practice: Use PHS + Conditional Access + MFA. Retire ADFS.

Migration Roadmap

Phase 1: Discovery & Dependency Mapping (Weeks 1-4)

Audit all GPOs, identify NTLM dependencies, catalog legacy apps. Run Microsoft's Group Policy analytics tool. Export AD schema and custom attributes. Identify apps without service principals.

Phase 2: Pilot Migration (Weeks 5-12)

Create pilot OU in AD. Install Entra Cloud Sync agents. Configure hybrid join for pilot devices. Translate critical GPOs to Intune policies. Test NTLM → OAuth migrations for 2-3 apps.

Phase 3: Wave Migrations (Weeks 13-40)

Migrate users/devices in waves (typically 10-20% per wave). Use OU-based scoping. Register all app service principals. Refactor legacy auth for critical apps. Decommission Azure AD Connect, switch to Cloud Sync.

Phase 4: Decommission On-Prem AD (Weeks 41-52)

Retire Domain Controllers. Move all devices to pure Entra ID join (not hybrid). Sunset ADFS/PTA, migrate to PHS + Conditional Access.

Total Cost of Ownership (TCO)

Migration costs money up front; ongoing costs then fall.

Break-even: Typically 18-24 months, driven by elimination of on-prem infrastructure and admin reduction.

Architecture: The Translation Layer

Before (Active Directory)

• Identity: On-prem Domain Controllers (Windows Server 2016+)
• Auth: NTLM, Kerberos, ADFS (federation)
• Device Trust: Domain Join
• Policy: Group Policy Objects (500+ GPOs common)

After (Microsoft Entra ID)

• Identity: Cloud-managed Entra ID (no on-prem DCs)
• Auth: OAuth 2.0, OIDC, SAML (modern auth)
• Device Trust: Entra ID Join (cloud-native)
• Policy: Microsoft Intune (Settings Catalog, OMA-URI profiles)

How to Choose a Migration Partner

If you need a pure Microsoft specialist: Avanade or Ferrara IT. These firms are 100% Microsoft-focused, with thousands of Entra ID migrations under their belt.

If you are a Fortune 500: Accenture or Deloitte. You need a partner who can handle organizational change management, compliance (HIPAA, SOC 2), and the scale of 50,000+ users.

If you need licensing optimization: SoftwareOne. If your goal is to escape E3 → E5 upsell traps while migrating identity, they'll model the TCO and find cost savings.

Red flags when evaluating vendors:

• "We'll just move everything to Intune in 2 weeks." (False. GPO translation alone takes months for complex environments.)
• No mention of NTLM dependencies. (They haven't done discovery. Apps will break post-migration.)
• Weak service principal audit. (If they don't ask about third-party and multitenant apps that call your tenant, they don't understand Microsoft's service principal requirement.)

How We Select Vendors

We compared these firms on:

• Microsoft Competency: Identity & Access Management and Modernize Endpoints competencies.
• Case Studies: Proven track record of hybrid → cloud identity transitions with GPO translation.
• NTLM Modernization Expertise: Ability to refactor legacy apps to modern auth, not just document the gap.

Vetting Process:

1. Analyze partner case studies for specific "AD to Entra ID" examples with GPO→Intune details.
2. Verify Microsoft partnership tier and certifications.
3. Evaluate their approach to NTLM sunset and the service principal requirement.
4. Exclude firms that rely on "lift and shift" without modernization strategy.

FAQ

How long does an Active Directory to Entra ID migration take?

For a mid-sized enterprise (1,000-5,000 users, 50 GPOs), expect 6-9 months. Large enterprises with complex AD forests, custom apps, and regulatory requirements often take 12-18 months. The timeline is dictated by GPO translation complexity and NTLM app modernization.

Is Entra ID cheaper than on-premises Active Directory?

Yes, for ongoing costs. On-prem AD costs $180K/year (domain controllers, SQL licensing, admin overhead). Entra ID P2 costs $9/user/month ($108K/year for 1,000 users). However, migration costs ($150K-$800K) create a break-even point at 18-24 months.

Can Group Policy Objects (GPOs) be directly migrated to Intune?

No. Microsoft's Group Policy analytics tool shows which GPO settings have Intune equivalents, but many Group Policy Preferences (drive mappings, scheduled tasks) and user registry settings require OMA-URI custom profiles or PowerShell scripting. Expect 30-50% of GPOs to need manual translation.

What happens to legacy apps using NTLM authentication?

They can break once network NTLM is disabled, which Microsoft plans to make the default in the next major Windows Server release (no date announced; it can be re-enabled by policy). Legacy apps must be refactored to modern auth (OAuth 2.0, SAML) or use Entra ID Domain Services (a managed AD in the cloud) as a temporary bridge. Long-term, app modernization is mandatory.

What is the March 2026 service principal deadline?

On 31 March 2026 Microsoft scheduled Entra ID to stop supporting service principal-less authentication, meaning non-Microsoft multitenant apps that authenticate in a tenant without a service principal there are blocked (Microsoft Learn). The date has passed. Check your service principal sign-in logs for apps still authenticating without one, and create a service principal for each app you want to keep.

Should I use hybrid join or pure Entra ID join?

Hybrid join (devices trust both AD and Entra ID) is a transitional strategy for organizations with legacy apps requiring on-prem access. Pure Entra ID join is the end goal for cloud-native identity. Most orgs use hybrid for 12-24 months, then migrate to pure cloud join.

Evidence note: Earlier versions of this page cited project counts, median costs and timelines, and success rates that could not be reproduced from available records; they have been withdrawn. Cost and timeline ranges are editorial scoping ranges, not supplier quotes. See our methodology.

Risk Factors

Group Policy to Intune Translation Gaps

Group Policy Preferences (drive mappings, scheduled tasks) and user registry settings lack direct Intune equivalents, requiring OMA-URI custom profiles or scripting.

NTLM Authentication Sunset

Microsoft plans to disable network NTLM by default in the next major Windows Server release and its associated Windows client releases (no date announced). Apps hardcoded to NTLM will break unless NTLM is re-enabled by policy. Moving to Kerberos or modern auth (OAuth/OIDC) is the durable fix but complex for custom apps.

Service Principal Requirement (scheduled March 2026)

Microsoft scheduled 31 March 2026 as the date Entra ID stops allowing multitenant apps to authenticate without a service principal in the tenant. That date has passed, so any remaining app without one is blocked or at risk of being blocked. Check service principal sign-in logs for failures.

Feasibility Analysis

Ideal candidates

• Organization is >80% Microsoft 365 — Entra ID P1/P2 already licensed
• On-premise AD has <5 domain controllers and <5,000 users
• No legacy NTLM-dependent LOB applications

Break-even cost: $180k/year in domain controller infrastructure savings Talent risk: Low. Microsoft-certified identity engineers are widely available.