Microsoft Entra ID can become the main directory for a small business whose applications and devices can operate without on-premises Active Directory. It does not automatically replace the services a business application, file share or Windows infrastructure depends on. Before removing the last domain controller, every dependency must be eliminated, replaced or retained within an explicitly chosen architecture.
The names cause confusion. Azure Active Directory was renamed Microsoft Entra ID; Windows Server Active Directory did not simply change its name. They are different services. See Microsoft's naming clarification.
Also distinguish the service from the machine: removing AD DS does not remove files or applications hosted on the same server. Retiring the domain and retiring the server can be separate stages, with their own costs and conditions.
Three different directory services
Active Directory Domain Services, or AD DS, provides a Windows domain, authentication functions and Group Policy, among other services. Entra ID manages identities and access to compatible applications, including Microsoft 365. Microsoft Entra Domain Services is different again: a managed domain service in Azure for certain compatibility needs. See the directory services comparison.
| Solution | Typical use | What you should not infer |
|---|---|---|
| AD DS | Applications and resources that depend on a Windows domain | That it must remain forever simply because it already exists |
| Entra ID | Identities and access for cloud or integrated applications | That it reproduces every AD DS protocol and policy |
| Entra Domain Services | Some applications needing domain capabilities in Azure | That it is a free checkbox replacing every local controller |
Modern device management also involves a management tool, such as Intune. Joining a computer to Entra ID and applying its settings are separate matters to verify. Microsoft's AD and Entra ID comparison helps distinguish their roles.
Start with dependencies, not accounts
Every employee having a Microsoft 365 address does not prove that the business can retire its domain. An application may query the directory through LDAP. A Windows service may run under a domain account. A file share may still have permissions tied to domain identities.
Build an inventory linking each service to its business use. “Server SRV01” is too vague. “Application that produces delivery notes, authenticates through the domain and is used by the workshop” identifies who must participate in testing.
| Item to examine | Concrete question | Evidence to keep |
|---|---|---|
| Business applications | How does the user sign in? | Observed configuration and vendor confirmation |
| Service accounts and scheduled tasks | Which account runs the process? | Task inventory and a test using the replacement identity |
| Files and permissions | Which identities own the permissions? | Allowed and denied access after migration |
| Workstation settings | Which GPOs are still needed? | A list of policies retained, replaced or retired |
| Wi-Fi, VPN and equipment | Which service validates the identity? | A diagram and a fresh connection test |
| DNS, certificates and other roles | Does the server provide anything besides the directory? | Role inventory and each role's destination |
Include infrequent activities: accounting close, monthly exports, supplier access and emergency procedures. An incident-free week may simply mean that the monthly process has not run yet.
If current permissions are already difficult to understand, structuring Active Directory is still worthwhile. Moving an unexplained permission list to another platform does not fix its governance.
A device appearing in Entra has not necessarily left the domain
Microsoft distinguishes several device identity states. They do not describe the same migration.
An Entra registered device has an identity that can be used for resource access. Registration does not mean it is Entra joined or enrolled in a management tool. Microsoft explicitly distinguishes registration from management enrollment.
A hybrid joined device remains joined to on-premises Active Directory while also having an Entra identity. It retains a need for periodic communication with domain controllers. This state does not establish that the domain can disappear. See how hybrid join works.
Even an Entra ID joined device may use a domain controller to access some local resources. Successfully opening a share from that device validates coexistence, not independence from domain authentication. Microsoft describes the conditions for this single sign-on to on-premises resources.
Request two separate pieces of evidence: the device's actual join state and the service authenticating each use. Add a test with a new identity. A familiar session may work using cached information and conceal an active dependency.
Fictional example: a 28-person business
Imagine a company using Microsoft 365, a file server and a sales management application. Its laptops can be prepared for modern management, but the software vendor confirms that the current authentication method requires the Windows domain.
| Fictional dependency | What the inventory reveals | Decision and exit condition |
|---|---|---|
| Users work in Microsoft 365, but accounts are synchronized | Separately test the future identity creation, modification and deletion lifecycle | |
| Team documents | Share permissions use AD groups | Test the destination, permissions and offline use with folder owners |
| Sales management | The vendor confirms domain-dependent authentication | Removal of the last controller is blocked until a supported domain-independent method is validated |
| Laptops | Some GPOs remain necessary for encryption and business settings | Recreate useful policies in the target management system and verify application |
| Monthly accounting export | A task uses a domain account; no replacement test has occurred | Dependency unresolved, even if workstations have worked for a week |
In this example, moving documents and laptops does not yet allow AD DS to be removed. Sales management and the accounting export each have an exit condition. The application owner and accounting owner need to validate their replacement workflows.
A decision record could say: “Retain AD DS for sales management and the accounting export. Reconsider retirement after the vendor confirms a supported method and the export succeeds with its replacement identity.” This identifies the blocker, who must supply evidence and what would change the decision. A project end date replaces none of those requirements.
Prepare migration around groups of business activities
Choose a scope small enough to correct but representative enough to reveal real problems. An administrator's workstation does not necessarily represent an assistant's computer with macros, a scanner and invoicing software.
Prepare identities. For users, groups and passwords, identify which system is authoritative before and after cutover. Rehearse three operations: an employee joining, a permission change and a departure. If the team does not know where to make a change, the future administration model is not ready. Simply stopping synchronization does not transfer that responsibility.
Prepare devices. Check user profiles, local files, encryption, applications and recovery methods. Changing the join state may require profile migration or reprovisioning. Allow for downtime and support at the first startup.
Prepare services. Address file paths, printers, certificates, tasks and technical accounts. A shortcut still pointing to the old server can stop work even when authentication appears correct.
Prepare rollback. Define the point after which new writes prevent a straightforward return. If documents have changed at the new destination, plan how to recover those changes before restoring the previous setup.
Hosting is a separate decision. Our on-premises versus cloud server comparison connects availability, applications and operations.
Checks before retiring the last controller
Acceptance testing must distinguish “it still works” from “it works without the service we intend to remove.” Look for the following evidence in a representative test environment or a controlled maintenance window.
| Test | What it must demonstrate | Misleading sign of success |
|---|---|---|
| New user on a device prepared for the target | The full identity and access lifecycle works | An existing user signs in with cached information |
| Local resources from an Entra ID joined device | Remaining dependencies are identified | The share opens while still using a domain controller |
| Device security settings | Useful policies are applied by the new management tool | A device retains an old setting but cannot receive it again |
| Files and business application | Permitted access succeeds and excluded access is denied | Only the administrator account has been tested |
| Monthly process and technical account | The business output is produced using the target identity | The service runs but its export is empty or errors are not monitored |
| Employee departure and access recovery | The new administration model supports removal and emergency access | Daily sign-in works but nobody can manage a departure |
Add the technical services being moved: DNS, certificates and other roles found in the inventory. Link each GPO to its purpose, any replacement and its test. “Migrate every GPO” is too vague: some policies are obsolete, while others have no direct equivalent.
Retirement is ready when every dependency has been removed or made independent of the domain, tests have been accepted and rollback is prepared. Cite that evidence in the decision. If a use remains unexplained, retain the necessary component and document the remaining work.
Do not abruptly switch off a production domain controller to discover dependencies. Plan the test scope, suitable backups, available people and stop criteria. Final retirement then needs an environment-specific technical procedure addressing synchronization, roles and residual references.
Common questions
Does Entra ID replace GPOs?
Entra ID is not a Group Policy engine identical to AD DS. In a modern target environment, settings are generally handled by a device management tool. Check necessary policies individually: some have an equivalent, some need redesigning and others are no longer useful.
Should you retain a hybrid architecture?
Only when it addresses an explicit dependency or transition stage. It can be entirely appropriate. It does, however, retain multiple components to administer, secure and monitor. Document why each remains and who owns it, even if there is no near-term exit plan.
Can you remove the server after moving its files?
Not on that evidence alone. The server may host several roles, and other equipment may use the domain. You need an inventory in which every dependency has been resolved and its replacement validated, not just a successful folder copy.
Price retention and retirement against the same scope
Keeping the domain includes operations, updates, backups and recovery. Leaving it includes application changes, identities, devices, data and user support. Comparing a cloud subscription with the server's purchase price omits work from both scenarios.
An IT architecture assessment should connect these costs to the dependencies identified. To prepare an Initial Infra assessment, start with applications whose loss would prevent invoicing, production or delivery. Their authentication methods will often determine what can move first and what must wait.
Microsoft documentation reviewed on 9 October 2026. The 28-person scenario is fictional; it illustrates a method, not a migration carried out by Initial Infra. English translation prepared on 12 October; evolving details must be rechecked before publication.
View sources (7)
Support available on this topic
Initial Infra handles these topics for SMBs and mid-size companies. A short call is enough to identify priorities and the right scope of intervention.