What is Azure? Can it replace an on premise Active Directory?

Question

As you might guess, I'm a complete newbie to Azure and have no knowledge of it at all.
I have a project for which I need to find the most efficient and cost effective solution. Rather than me ask questions, perhaps its better I explain the project and hopefully someone will be able to tell me if Azure will provide a solution.
I have an on premise SBS 2003 R2 server which I need to replace due to the end of life of Server 2003 R2. This server provides, AD, Exchange and File & Print services to around 40 users. I have been given the remit of 'spend as little as possible
and use Cloud services as much as possible' to achieve the migration but I don't want it to be at the expense of productivity and end user harmony.
I have started trialling Office 365, which will hopefully take care of the File and Exchange side of things. So far the users have found it a bit frustrating trying to navigate to files on SharePoint. They are unable to effectively map a drive or explore
to SharePoint and they are frequently asked to enter their O365 password, on top of their local domain password. Although I've not tried Single Sign On, it sounds like this might resolve the issues we're having with O365.
From what I've heard, I'd need an on premise AD server in order to implement Single Sign On, so this means buying a new on premise 2012 server to replace the 2003 SBS server. This obviously means expense. I'm wondering if there is an alternative solution
that addresses the Single Sign On problem and gives me AD features, such as group policy, but without the necessity for an on premise server. Ideally it would also give me print server features too.
Has anyone any idea if Azure can provide an effective solution to my project or have any other solutions. If not, I'll have to get the on premise server.

Answer 1

Hi TIMTAM73,
This is actually a great topic around the position of Azure for the Enterprise environment and how Azure AD might help.
You've earlier mentioned that you're currently trial-ing O365, for which I truly congratulate you. In my opinion, that's by far the best SaaS product for organizations looking for a professional Exchange, SharePoint and CRM solution.
Please let me also introduce a new term to the discussion, namely Azure Active Directory (AAD, for short). AAD is what the entire Office 365 users & groups repository is based on.
In terms of Windows Server Active Directory, if you're looking to domain-join your organizational computers after you ditch your ancient-WS2003 server, please be advised that AAD won't help, because currently AAD is NOT an LDAP, meaning that it's only
a little more than a user&groups repository and that's it. However, because you were advised to look more into cloud services, please note that there's always the option of deploying a VM with Windows Server 2012 R2 installed and install the role of Active
Directory Domain Services on it. This also means that you get LDAP, but on a newer system.
Afterwards, you'll have to worry how your organizational computers will join the domain you created "in the cloud". Here's where Azure Virtual Networks come in. Considering that you have a decent router, you have the option of creating a site-to-site
VPN and thus connect your local LAN to a network of cloud services which will be hosted on the same IP classes where your computers are: voila, you get domain-joined computers on a cloud-hosted VM.
Lastly, because Exchange might be too expensive to acquire and maintain, I suggest you look into Office 365. Here, you have the option of using the so-called AD Connect (or the generally available and tested DirSync option) which will synchronize your users
and (optionally) password hashes. Additionally, there's also the option of Single-Sing-On (SSO), which will help your users from having to regulary input their credentials.
As for the File and Exchange things, you have a few options:
Use OneDrive for Business and thus your users will get a OneDrive repo directly in File Explorer
Deploy a VM on your cloud service which has the File and Document role installed, with the Work Folders feature and afterwords configure Work Folders on your users' Windows 7/8 PCs
...or simply use a SMB share or FTP on that VM on Azue
Please keep in mind that when it comes to document sharing, it would be best to add at least an additional data drive (with no write caching) and configure the shares on this/these drives. Never use the D:\ drive on the VM - that a temporary storage solution
designed for caching in IIS, for example - or C:\ - the OS disk has write caching applied and you'll eventually get into lots of trouble with your users for loosing their data :).
I hope this helps. I'll be happy to give you more insights and put you on the right track if you miss finding the right documentation.
Alex