# active-directory

Source: https://startwithidentity.com/glossary/active-directory/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

Microsoft's on-premises directory service, providing authentication, authorization, group policy, and a hierarchical store of users, computers, and groups for a Windows domain. It authenticates with Kerberos, falls back to NTLM, and exposes its directory over LDAP.

Active Directory has been the centre of enterprise identity since 2000 and remains so at most organizations, including those that consider themselves cloud-first: the cloud tenant is usually synchronized from it, which makes the on-premises domain a path into the cloud one. That hybrid seam is where a large share of real intrusions travel. Entra ID is a separate product with a different model, not a hosted version of Active Directory, and conflating the two causes both architectural and security mistakes.

See also: [Kerberos](https://startwithidentity.com/glossary/kerberos/), [LDAP](https://startwithidentity.com/glossary/ldap/), [NTLM](https://startwithidentity.com/glossary/ntlm/), [primary refresh token theft](https://startwithidentity.com/techniques/primary-refresh-token-theft/), [best ITDR for Active Directory](https://startwithidentity.com/rankings/best-itdr-for-active-directory/), [directory service](https://startwithidentity.com/glossary/directory-service/)