Microsoft Entra ID

Formerly Microsoft Azure Active Directory

Scenario 1: The most obvious would be if the org. has Azure presence with or without an on-premises AD instance. Scenario 2: Even from an SSO point-of-view, Microsoft Entra ID would be a great choice to be opted as an Identity Provider. Scenario 3: If the org. has a wide global footprint and wants to ensure a secure identity and access management platform that can prevent real time attacks without compromising user experience. Scenario 4: If the org. has both B2B and B2C collaboration scenarios.

It reduces the risk of fraud by ensuring that only authorized individuals can approve important transactions through biometric authentication. In an era of remote work, the software's MFA features have been incredibly beneficial. It allows our remote workers to securely and easily access financial systems and data from anywhere. Microsoft Entra ID is effective in controlling access, permitting only authorized individuals to view private financial data and systems.

Setting up MFA has been one of the best things we implemented throughout our organization, and it used with numerous applications.
We also use the federation services a tremendous amount to synchronize with our on-prem environment.

Some of the application proxy setups don't work very well with some of our internal applications and information to help troubleshoot is difficult to find.

Microsoft Authenticator is well-suited for scenarios where strong, two-factor authentication is required. This includes situations where users need to access sensitive or personal information, such as online banking or email accounts. It is also well-suited for use in enterprise environments, where administrators can use the app to secure employee access to company resources and data.On the other hand, scenarios where Microsoft Authenticator may be less appropriate include those where users need to access resources from multiple devices or platforms. Since Microsoft Authenticator is primarily a mobile app, it may not be the best option for users who primarily use computers or other devices. Additionally, scenarios where users need to authenticate to a wide range of services, apps, or websites that do not support Microsoft Authenticator may not be well suited.It's also less appropriate for scenarios where users are not comfortable using mobile devices or apps, or if users are in areas with poor mobile network coverage, as it may not be able to provide a smooth authentication process.

The entire experience of using a full suite of Azure products has been a great one. Everything is well integrated. CLI access is feature full and often times well documented. Additionally, leveraging azure in other areas means pretty seamless integration experiences across the board. Overall, very pleased with the AAD experience.

AzureAD is a very reliable and quick to setup service, If you have:

1. Active Directory as your on-premises domain service
2. Plan to use a cloud-based productivity service such as Microsoft 365
3. Have any Azure-resources
4. Use Microsoft Teams
5. Need to have a familiar interface with familiar tools and extensive documentation
6. Want to reduce the number of IAM Solutions you are using

Then AzureAD is definately your choice, it supports all the above and is very flexible and relatively simple to get up to speed quickly

However, if you plan to use cloud services from other providers such as Google, then you might consider other options or preferrably use Google Cloud Directory for that matter, AzureAD is tailored for businesses who have capitialized many of their IT Investments in the Microsoft Ecosystem and therefore, serves them the most.

I think that Microsoft Azure Active Directory is going to be applicable to any organization that needs a cloud identity solution and they have more than a handful of employees and users. Licensing could be problematic to figure out, and bundling the Microsoft Azure Active Directory license with an M365 subscription is probably the route to take. However, I would not recommend this product to an organization with an IT administrator who is not strong technically. In this case, it might be better managed by an MSP.

The reality is that Microsoft Azure Active Directory is one part of a suite of products and it is sometimes hard to look at it without understanding how it interacts with the other tools in the suite. If we take this into consideration, then Microsoft Azure Active Directory is the backbone for providing a cloud-based user identity and security solution that will be applicable under any circumstance.

Azure AD is actually required for Office 365 to work, so obviously you won't have a choice about whether or not it is well-suited unless you want to skip Office 365 completely. But it's actually a good standalone AD solution for when you don't want to own any infrastructure at all. That's because AAD is hosted by Microsoft in their commercial cloud, Azure. You could hypothetically build all a full corporate directory against which to authenticate without having to own a single server.

I would not advise using AAD as your network directory as a standalone solution, however. You would need to have at least one on-premise AD domain controller with a full copy of the directory, at all times. This is required because Azure Active Directory operates in the cloud, meaning it is reached by way of the internet. If any site were to become disconnected from the internet for any reason, and if there is NOT a local copy of the directory on a domain controller that the users and computers can reach from their devices, no one would be able to authenticate to any resources until connectivity is restored.