Introduction

This post explains the differences between Active Directory Domain Services (AD DS) and Active Directory Federation Services (AD FS). It also explains how these two roles operate with cloud computing environments.

Comparison of AD DS and AD FS

1. Active Directory Domain Services (AD DS)

• Function: AD DS is the primary directory database for local networks.
• Data Storage: AD DS stores data about users, computers, and security groups.
• Network Area: AD DS controls access to local network resources.
• Network Protocols: AD DS uses traditional protocols. These protocols include Kerberos and LDAP.

2. Active Directory Federation Services (AD FS)

• Function: AD FS provides Single Sign-On (SSO) for web applications and external applications.
• Data Storage: AD FS does not store user data. It uses the data from AD DS to verify identity.
• Network Area: AD FS extends user access outside the local network firewall.
• Network Protocols: AD FS uses modern token-based protocols. These protocols include SAML and OAuth.

Operation with Cloud Computing Environments

AD DS and AD FS are not native services of cloud computing environments. Both technologies are software roles in Windows Server.

How to use AD DS with Cloud Computing

You can install AD DS on a Windows Server Virtual Machine (VM) in a cloud computing infrastructure. Examples include Microsoft Azure and AWS.

The native alternative for cloud computing environments is Microsoft Entra ID (previously Azure AD). Microsoft Entra ID has a different architecture. You can synchronize AD DS with Microsoft Entra ID when you use Microsoft Entra Connect.

How to use AD FS with Cloud Computing

AD FS operates as a bridge between your local network and cloud computing environments. It lets local users log into cloud applications with corporate credentials. AD FS does not send user passwords to the cloud computing environment.

To run AD FS in a cloud computing environment, you must deploy and manage Windows Server VMs, load balancers, and proxy servers.

Modern Replacement

Many companies replace AD FS infrastructure with Microsoft Entra ID cloud authentication. This native cloud solution reduces the number of local servers that you must maintain.