Azure/EntraID and Activate
Activate can be hosted on-premises, in a customer-managed cloud, or in a hybrid configuration. The platform is designed for flexibility and integrates tightly with identity, access, and security systems to support both traditional and modern enterprise environments.
Hosting Overview
On-Premises Hosting
All components are installed within the customer’s on-premises infrastructure. This model provides full control over configuration, network security, and system integration. It is typically used where:
- Direct integration with on-premises Active Directory and Exchange is required
- Strict data residency or compliance policies exist
- Cloud connectivity is restricted or not permitted
Cloud Hosting
Activate can also be deployed to a dedicated virtual machine in a customer-managed cloud environment such as Azure or AWS. This allows organisations to benefit from cloud scalability while maintaining control of their environment. To ensure reliable integration with identity systems, cloud-hosted Activate servers must have secure and low-latency connectivity to Active Directory, Microsoft Entra ID and related services.
Hybrid Deployments
Most enterprise environments use a hybrid model — combining Active Directory with Microsoft Entra ID through Microsoft Entra Connect. This approach aligns with Microsoft’s recommended best practice for identity management and allows Activate to manage both on-premises and cloud-based resources in a unified manner.
Activate requires membership of the Active Directory domain or Microsoft Entra ID tenant it manages, whether hosted on-premises or in the cloud.
Integration with Microsoft 365 and Azure
Activate integrates directly with Microsoft Entra ID and Azure to provision, manage, and synchronise user and service data. Integration is achieved through a combination of Microsoft Graph and Remote PowerShell. New functionality is continually added as Microsoft extends the Graph API.
- Microsoft Graph API – Preferred for modern, secure, and high-performance integration
- Remote PowerShell – Used where Graph does not yet support required functionality
- Virtual LDAP Connector – Provides LDAP-style access to Microsoft Entra ID through Graph (introduced in v7.1.1)
Over time, Activate is transitioning all Microsoft integrations to Graph API in line with Microsoft’s roadmap.
Supported Microsoft Modules
The following Activate modules integrate with Microsoft_365 and Azure to automate provisioning and access management. Each requires Activate to be registered in the Azure tenant as an Application Registration.
Module | Function |
|---|---|
User Manager | Create and remove Azure users; assign licences and mailboxes |
Services Manager | Manage Office 365 licences, Exchange mailboxes, and Azure groups |
Role & Entitlements Manager | Manage Azure group membership and service access |
Shared Mailbox Manager | Manage Exchange Online shared mailboxes |
Microsoft Teams Manager | Create and manage Microsoft Teams groups |
Connector | Access to Dynamics 365 and other connected services |
The exact configuration depends on the organisation’s Microsoft 365 and Azure integration model.
Group and Directory Management
Activate supports group and access management for both on-premises and cloud-based environments. Where hybrid identity is used, the recommended approach is to manage groups locally and synchronise changes to Azure via Microsoft Entra Connect
This approach:
- Simplifies management and troubleshooting
- Reduces dependency on remote APIs
- Maintains consistency between on-premises and cloud directories
The exception is the Microsoft Teams Manager module, which manages Microsoft Teams and their associated Azure groups directly via Graph.
Azure Group Types
Microsoft supports several types of groups in Azure. The following table summarises their common uses and management options. (Refer to Microsoft Graph group documentation for details.)
Group Type | Description | Mail Enabled | Security Enabled | API Management |
|---|---|---|---|---|
Microsoft 365 Groups | Collaboration groups with shared resources | ✔ | ✖ | Supported via Graph |
Security Groups | Access control for apps and resources | ✖ | ✔ | Supported via Graph |
Mail-enabled Security Groups | Access control with shared mailbox | ✔ | ✔ | Not supported |
Distribution Groups | Email distribution lists | ✔ | ✖ | Not supported |
Recommendations
- Manage traditional distribution groups on-premises and synchronise via Microsoft Entra Connect where possible.
- Use Microsoft 365 Groups instead of legacy distribution groups for collaboration and email.
- Where required, Activate supports management of Azure-only distribution groups via Remote PowerShell.
- Avoid removing the final on-premises Exchange server if Microsoft Entra ID synchronisation is in use.
Maintenance and Updates
Azure and Microsoft Entra ID continue to evolve at a rapid pace. To ensure continued compatibility with Microsoft API changes and security updates, we recommended that organisations apply the latest Activate update every 6–9 months.