Insights
Moving from Active Directory and ADFS to Entra ID
The order we use to retire on-premises identity without disrupting people.
Many organisations still run on-premises Active Directory, often with AD FS (Active Directory Federation Services) for sign-in to Microsoft 365, long after email and files moved to the cloud. The servers need patching, backing up and securing, and devices still depend on the office network. Moving from Active Directory to Entra ID, cloud only, removes all of that. This is the order we use, and the Microsoft guidance behind each step.
1. Prepare
- List everything that still depends on Active Directory: printers, Wi-Fi, file shares, line-of-business apps and any service accounts.
- Create two cloud-only emergency access accounts, as Microsoft recommends, so you can always get back into the tenant.
- Deploy Windows LAPS (Local Administrator Password Solution) so every device has a unique, rotated local admin password backed up to Entra ID. Microsoft supports this for both hybrid joined and Entra joined devices.
- Move people’s Desktop, Documents and Pictures folders to OneDrive with Known Folder Move, so no files live only on a device.
- Back up the AD FS configuration before you change anything.
2. Move sign-in from AD FS to Entra ID
Microsoft recommends password hash sync for cloud authentication. Turn it on in Entra Connect, then use staged rollout to move a pilot group to cloud sign-in while everyone else stays on AD FS. Staged rollout is for testing: it does not convert your domains. The final cut-over is done with Entra Connect or PowerShell, which switches each domain from federated to managed. Domains do not have to move together, and Microsoft suggests starting with a test domain or the one with the fewest users.
People keep the same username and password. Sign-in now happens in Entra ID, protected by multi-factor authentication and conditional access. One exception to check early: Microsoft says non-persistent virtual desktops on Windows 10 version 1903 or later must stay on a federated domain.
3. Move devices
This is the step that takes the most planning. Microsoft is plain about it: there is no supported way to convert a Windows device from hybrid join to Entra join without resetting Windows, and Windows Autopilot Reset does not support hybrid joined devices, so they need a full wipe. Microsoft suggests moving each device at a natural point, such as a hardware refresh or an operating system upgrade, and recommends that new devices are Entra joined from the start.
You do not have to move everything at once. Entra joined and hybrid joined devices can run side by side, and people on Entra joined devices can still reach on-premises resources while those remain. Macs can sign in with Entra ID through Platform SSO, managed by Jamf or Intune.
4. Move user accounts to the cloud
Once devices and sign-in no longer depend on Active Directory, users and groups can be managed in Entra ID. There are two routes:
- Microsoft now documents transferring the source of authority for users and groups to Entra ID, one object at a time. Its prerequisites include no on-premises Exchange workloads, and it is not supported while users still sign in through AD FS. That is another reason to move sign-in first.
- When nothing needs Active Directory any more, turning off directory synchronisation converts every synced user and group to cloud-only. Microsoft advises uninstalling the sync client first if the change is permanent, and once sync is off you must wait 72 hours before you could turn it back on.
5. Decommission
Retire AD FS, remove Entra Connect and decommission the domain controllers. Keep backups for an agreed period, then remove the servers permanently. From then on, starters, leavers and password resets happen in one place.
Order matters
The most common mistake is converting users before their devices have moved. Devices that are still hybrid joined expect to find matching accounts in Active Directory. The safe order is: sign-in first, then devices, then users, then remove the servers.
What it looks like in practice
Toynbee Hall, a charity in east London, made exactly this move. We produced architecture diagrams and a project plan, moved sign-in from AD FS to cloud authentication in Entra ID, then moved accounts and devices so they no longer depended on the on-premises directory. Each stage was tested before the next one started, so staff could keep working. Macs now use Jamf Connect with Platform SSO.
How we help
We plan and deliver these migrations from start to finish, with architecture diagrams, a written plan, user communications and runbooks for each phase. See our projects and transformation service, our Microsoft 365 and Entra ID work and Microsoft Intune, or book a call.
Frequently asked questions
Can’t see your question? Call us on +44 20 7550 9103 or book a call.
How long does it take?
It depends on the number of users, devices and apps that rely on Active Directory. We plan it in phases, so we can check each step before the next one starts.
Will people have to change their password?
Usually not. People keep their username and password; sign-in simply moves from AD FS to Microsoft Entra ID with multi-factor authentication. Microsoft recommends password hash sync for cloud authentication when moving from AD FS, which is what lets the existing password carry on working.
What about printers and old applications?
We identify anything that still relies on Active Directory early, such as printers, file shares and older applications, and plan a cloud alternative or a workaround before the servers are removed. Devices move before users, so nothing is cut off while it still depends on the old domain.
Do we have to reset every Windows PC?
Eventually, yes, for hybrid joined PCs. Microsoft has no supported way to convert hybrid join to Entra join without resetting Windows, so we usually move each PC when it is replaced or rebuilt.
Can hybrid joined and Entra joined devices run side by side?
Yes. Microsoft supports both in the same environment, so devices can move in waves. Running both adds some complexity, so we plan an end date for hybrid join.
What happens to Macs?
Macs can sign in with their Entra ID account through Platform SSO, managed by Jamf or Intune, so they no longer need Active Directory either.
Get new guides by email
Practical updates on Apple, Jamf, Microsoft 365 and security. Unsubscribe at any time.
Start with a 1-hour conversation
Tell us what you want your IT to do next. We’ll ask about your people, devices and plans, and tell you honestly whether we’re the right fit.
London head office
Postremo IT Limited
Level 24, One Canada Square
Canary Wharf
London E14 5AB
+44 20 7550 9103
info@postremoit.com
Also in Dubai
Business Bay, Dubai