Active Directory to Microsoft Entra ID Migration Center¶

The definitive resource for migrating from on-premises Active Directory to Microsoft Entra ID --- the Zero Trust identity control plane for CSA-in-a-Box and the modern enterprise.

Who this is for¶

This migration center serves federal CISOs, identity architects, IT administrators, platform engineers, and compliance officers who are evaluating or executing a migration from on-premises Active Directory to Microsoft Entra ID. Whether you are responding to Executive Order 14028 Zero Trust mandates, eliminating domain controller infrastructure, modernizing authentication from Kerberos/NTLM to OAuth/OIDC, preparing for Microsoft's June/July 2026 hard-match hardening enforcement, or establishing cloud-native identity as the foundation for CSA-in-a-Box deployment, these resources provide the evidence, patterns, and step-by-step guidance to execute confidently.

Quick-start decision matrix¶

Strategic resources¶

These documents provide the business case, cost analysis, and strategic framing for decision-makers.

Migration guides¶

Domain-specific deep dives covering every aspect of an AD-to-Entra-ID migration.

Tutorials¶

Step-by-step walkthroughs for key migration scenarios. {: #tutorials }

Technical references¶

Government and federal¶

How CSA-in-a-Box fits¶

CSA-in-a-Box uses Microsoft Entra ID as the identity backbone for every service in the platform. Identity is not a peripheral concern --- it is the Zero Trust control plane through which all access to data, analytics, AI, and governance services flows.

Identity integration points¶

flowchart TD
    EntraID[Microsoft Entra ID] --> Fabric[Microsoft Fabric\nWorkspace RBAC]
    EntraID --> Databricks[Azure Databricks\nSCIM Provisioning]
    EntraID --> Purview[Microsoft Purview\nData Access Policies]
    EntraID --> AI[Azure OpenAI / AI Foundry\nManaged Identity RBAC]
    EntraID --> PowerBI[Power BI\nRow-Level Security]
    EntraID --> Monitor[Azure Monitor\nDiagnostic RBAC]
    EntraID --> KeyVault[Azure Key Vault\nSecret Access]
    EntraID --> ADLS[ADLS Gen2\nStorage ACLs + RBAC]

    subgraph CSA["CSA-in-a-Box Platform"]
        Fabric
        Databricks
        Purview
        AI
        PowerBI
        Monitor
        KeyVault
        ADLS
    end

    style EntraID fill:#1565c0,color:#fff
    style CSA fill:#e8eaf6,color:#000

What Entra ID enables for CSA-in-a-Box¶

• Fabric workspaces: Entra security groups map directly to Fabric workspace roles (Admin, Member, Contributor, Viewer). Dynamic group membership automates access as users change roles.
• Databricks SCIM: Entra ID provisions and deprovisions users and groups into Databricks workspaces automatically via SCIM 2.0. Unity Catalog inherits these identities for table-level access control.
• Purview governance: Data access policies in Purview bind to Entra security groups. Data stewards manage access through Entra group membership, not per-resource ACLs.
• Azure OpenAI / AI Foundry: Managed identities (workload identities) authenticate service-to-service calls without credentials. User access governed by Entra RBAC roles.
• Power BI row-level security: RLS roles reference Entra group membership via USERPRINCIPALNAME() and CUSTOMDATA() DAX functions. No separate identity store.
• ADLS Gen2 storage: POSIX-style ACLs and Azure RBAC roles bind to Entra identities. No shared keys in production --- managed identity or user delegation SAS only.
• Key Vault: Secrets, keys, and certificates accessed exclusively through Entra RBAC. No access policy model in new deployments.
• Azure Monitor: Log Analytics workspace access controlled through Entra RBAC. Resource-context and workspace-context access models both reference Entra identities.

Why AD migration is a prerequisite¶

Without Entra ID as the identity provider, CSA-in-a-Box cannot enforce:

1. Conditional Access on data platform access (require compliant device, MFA, location policy)
2. Just-in-time admin elevation via PIM for Fabric/Databricks/Purview admin roles
3. Automated provisioning/deprovisioning via SCIM and Entra lifecycle workflows
4. Workload identity federation for CI/CD pipelines deploying Bicep templates
5. Cross-service SSO --- a single sign-on token from Entra ID authenticates to Fabric, Databricks, Purview, Power BI, and Azure Portal without separate credential stores

Performance and benchmarks¶

Best practices¶

Migration timeline overview¶

gantt
    title AD to Entra ID Migration Timeline
    dateFormat  YYYY-MM-DD
    axisFormat  %b %Y

    section Discovery
    Identity inventory        :a1, 2026-07-01, 4w
    Application dependency    :a2, after a1, 2w
    GPO analysis             :a3, after a1, 2w

    section Hybrid Identity
    Cloud Sync deployment    :b1, after a2, 3w
    Conditional Access       :b2, after b1, 2w
    PIM deployment           :b3, after b1, 2w

    section Applications
    AD FS migration          :c1, after b2, 8w
    LDAP app remediation     :c2, after b2, 12w
    App Proxy deployment     :c3, after c1, 4w

    section Devices
    Hybrid Join (interim)    :d1, after b2, 6w
    Intune enrollment        :d2, after d1, 8w
    Entra Join (target)      :d3, after d2, 12w

    section Security
    Passwordless deployment  :e1, after c1, 6w
    Identity Governance      :e2, after e1, 4w

    section Decommission
    AD FS decommission       :f1, after c3, 2w
    DC decommission          :f2, after d3, 4w

Document index¶

Maintainers: csa-inabox core team Last updated: 2026-04-30