Active Directory (AD)

What is Active Directory (AD)?

Active Directory (AD) is Microsoft's on-premises directory service that stores user accounts, groups, and computers for a Windows network and authenticates them through Kerberos and LDAP. Shipped with Windows 2000 Server, it remains the identity backbone of most European mid-market companies, including those now running the majority of their software in the cloud.

How Active Directory works

• A domain controller holds the directory database and answers every authentication request.
• Users, groups, computers, and printers are stored as objects across domains, trees, and forests.
• Authentication uses Kerberos by default, with NTLM kept as a legacy fallback.
• Applications query the directory over LDAP on port 389, or LDAPS on port 636.
• Group Policy pushes security and configuration rules to every machine joined to the domain.

What Active Directory does not cover

Active Directory governs Windows resources, not SaaS. When a team buys Slack, Notion, or Figma outside the domain, those accounts live entirely outside AD. That is where orphaned accounts and shadow IT accumulate: disabling an AD account does nothing to the fifty cloud tools a departing employee also had access to.

Examples and use cases

A 300-person manufacturer runs AD for file shares, VPN, and Windows logins, synced to Microsoft Entra ID for Microsoft 365. HR triggers an AD account on day one and the process works. The gap appears at offboarding: AD is disabled in minutes, but the engineer keeps an active GitHub, Datadog, and Miro seat because none of them was ever federated. Closing that gap needs a SaaS-aware governance layer on top of the directory, which is what Corma adds by connecting to the directory and covering the applications it never saw.

Related concepts

• Identity and access management platform
• Automated provisioning and onboarding
• Full visibility to prevent shadow IT

FAQ

Is Active Directory the same as Microsoft Entra ID?

No. Active Directory is the on-premises directory built on Kerberos and LDAP. Microsoft Entra ID, formerly Azure AD, is the cloud identity service built on SAML, OAuth 2.0, and OpenID Connect. Most companies run both and keep them in sync with Entra Connect.

Is Active Directory still used in 2026?

Yes. AD still handles Windows domain logins, file servers, VPN authentication, and legacy applications, even in companies whose daily work has moved almost entirely to SaaS.

What is an orphaned account in Active Directory?

An orphaned account is an AD object that no longer maps to an active employee or owner, usually left behind after a departure or a closed project. It is one of the most common findings in ISO 27001 and NIS2 audits.

Does disabling an Active Directory account revoke SaaS access?

Only for applications federated to AD or to Entra ID. Any SaaS tool with its own local login keeps working until someone deactivates the account inside that tool.

Request a demo