Complete Feature Mapping: Active Directory to Microsoft Entra ID¶

50+ Active Directory features mapped to their Microsoft Entra ID equivalents with migration complexity ratings, gap analysis, and CSA-in-a-Box integration points.

How to read this mapping¶

Each feature is rated by migration complexity:

1. Authentication¶

Authentication --- CSA-in-a-Box integration¶

All CSA-in-a-Box services authenticate through Entra ID:

# Verify SSO works for CSA-in-a-Box services
$token = Get-AzAccessToken -ResourceUrl "https://analysis.windows.net/powerbi/api"
# Token contains Entra ID claims used for:
# - Fabric workspace RBAC
# - Power BI row-level security
# - Databricks API access
# - Purview catalog access

2. Directory services¶

Directory services --- CSA-in-a-Box integration¶

# Dynamic group for Fabric workspace access
# All users in the "Data Engineering" department automatically get access
New-MgGroup -DisplayName "CSA-Fabric-DataEngineers" `
    -GroupTypes "DynamicMembership" `
    -MembershipRule '(user.department -eq "Data Engineering")' `
    -MembershipRuleProcessingState "On" `
    -SecurityEnabled $true `
    -MailEnabled $false `
    -MailNickname "csa-fabric-dataeng"

3. Group Policy and device management¶

GPO migration --- Group Policy Analytics¶

# Export GPO for Intune Group Policy Analytics
# Run on a domain controller or RSAT-equipped machine
Get-GPO -All | ForEach-Object {
    $gpoName = $_.DisplayName -replace '[\\/:*?"<>|]', '_'
    Get-GPOReport -Guid $_.Id -ReportType Xml -Path ".\GPO_Export\$gpoName.xml"
}
# Upload XML files to Intune > Devices > Group Policy Analytics

4. Authorization and access control¶

Authorization --- CSA-in-a-Box integration¶

5. PKI and certificate services¶

6. Network and infrastructure services¶

7. Federation and trust¶

8. Monitoring and auditing¶

Monitoring --- CSA-in-a-Box integration¶

// KQL query in Azure Monitor / Log Analytics
// Monitor sign-in failures to CSA-in-a-Box resources
SigninLogs
| where TimeGenerated > ago(24h)
| where ResourceDisplayName in (
    "Microsoft Fabric",
    "Azure Databricks",
    "Microsoft Purview",
    "Azure OpenAI Service",
    "Power BI Service"
)
| where ResultType != "0"  // Non-success
| summarize FailureCount = count() by
    UserPrincipalName,
    ResourceDisplayName,
    ResultDescription,
    ConditionalAccessStatus
| order by FailureCount desc

9. Identity lifecycle¶

10. Application integration¶

11. Compliance and governance¶

Migration complexity summary¶

Key findings¶

1. 50% of features migrate with XS or S effort --- these can be addressed in the first 4--6 weeks
2. 35% require moderate effort (M) --- these are the planning-intensive items that need application inventory and testing
3. 15% require significant effort (L/XL) --- primarily LDAP-dependent applications, complex GPO estates, and DFS infrastructure
4. No blocking gaps exist --- every AD feature has a functional Entra ID equivalent, though some require architectural adaptation

12. Migration priority matrix¶

Priority 1: Quick wins (XS/S complexity --- Week 1--4)¶

These features have direct 1:1 mappings and can be migrated with minimal planning:

Priority 2: Planned migration (M complexity --- Week 4--12)¶

These features require architectural planning but are well-documented migration paths:

Priority 3: Complex migration (L/XL complexity --- Week 12+)¶

These features require significant remediation or architectural changes:

13. Gap analysis --- features without direct equivalent¶

Features that require alternative approaches¶

Features that are better in Entra ID (no gap)¶

14. CSA-in-a-Box feature dependency matrix¶

Every CSA-in-a-Box service depends on specific Entra ID features. This matrix shows which AD migration milestones must be completed before each platform service is fully functional.

Implication¶

CSA-in-a-Box can begin deployment during Phase 1 (Hybrid Identity). The platform does not require full AD decommission to function. However, full Zero Trust enforcement (Conditional Access requiring compliant devices, passwordless authentication, PIM for admin roles) requires Phase 3+ completion.

15. Protocol migration reference¶

Authentication protocol mapping¶

Token format migration¶

Firewall port simplification¶

This port simplification significantly reduces the network attack surface and simplifies firewall rule management.

Maintainers: csa-inabox core team Last updated: 2026-04-30