---
title: Azure/EntraID and Activate
slug: azureentraid-and-activate
createdAt: 2025-11-03T21:43:40.792Z
---

Activate can be hosted **on-premises**, in a **customer-managed cloud**, or in a **hybrid** configuration.
The platform is designed for flexibility and integrates tightly with identity, access, and security systems to support both traditional and modern enterprise environments.

# Hosting Overview

# On-Premises Hosting

All components are installed within the customer’s on-premises infrastructure.
This model provides full control over configuration, network security, and system integration. It is typically used where:

- Direct integration with on-premises Active Directory and Exchange is required
- Strict data residency or compliance policies exist
- Cloud connectivity is restricted or not permitted

# Cloud Hosting

Activate can also be deployed to a **dedicated virtual machine** in a customer-managed cloud environment such as Azure or AWS.
This allows organisations to benefit from cloud scalability while maintaining control of their environment.
To ensure reliable integration with identity systems, cloud-hosted Activate servers must have secure and low-latency connectivity to Active Directory, Microsoft Entra ID and related services.

# Hybrid Deployments

Most enterprise environments use a **hybrid model** — combining Active Directory with Microsoft Entra ID through Microsoft Entra Connect.
This approach aligns with Microsoft’s recommended best practice for identity management and allows Activate to manage both on-premises and cloud-based resources in a unified manner.

:::hint{type="info"}
Activate requires membership of the Active Directory domain  or Microsoft Entra ID tenant it manages, whether hosted on-premises or in the cloud.
:::

# Integration with Microsoft 365 and Azure

Activate integrates directly with Microsoft Entra ID and Azure  to provision, manage, and synchronise user and service data.
Integration is achieved through a combination of **Microsoft Graph** and **Remote PowerShell**.
New functionality is continually added as Microsoft extends the Graph API.

- **Microsoft Graph API** – Preferred for modern, secure, and high-performance integration
- **Remote PowerShell** – Used where Graph does not yet support required functionality
- **Virtual LDAP Connector** – Provides LDAP-style access to Microsoft Entra ID through Graph (introduced in v7.1.1)

Over time, Activate is transitioning all Microsoft integrations to Graph API in line with Microsoft’s roadmap.

# Supported Microsoft Modules

The following Activate modules integrate with Microsoft\_365 and Azure to automate provisioning and access management.
Each requires Activate to be registered in the Azure tenant as an **Application Registration**.

| Module                          | Function                                                         |
| ------------------------------- | ---------------------------------------------------------------- |
| **User Manager**                | Create and remove Azure users; assign licences and mailboxes     |
| **Services Manager**            | Manage Office 365 licences, Exchange mailboxes, and Azure groups |
| **Role & Entitlements Manager** | Manage Azure group membership and service access                 |
| **Shared Mailbox Manager**      | Manage Exchange Online shared mailboxes                          |
| **Microsoft Teams Manager**     | Create and manage Microsoft Teams groups                         |
| **Connector**                   | Access to Dynamics 365 and other connected services              |

The exact configuration depends on the organisation’s Microsoft 365 and Azure integration model.

# Group and Directory Management

Activate supports group and access management for both on-premises and cloud-based environments.
Where hybrid identity is used, the recommended approach is to manage groups locally and synchronise changes to Azure via Microsoft Entra Connect 

This approach:

- Simplifies management and troubleshooting
- Reduces dependency on remote APIs
- Maintains consistency between on-premises and cloud directories

The exception is the **Microsoft Teams Manager** module, which manages Microsoft Teams and their associated Azure groups directly via Graph.

# Azure Group Types

Microsoft supports several types of groups in Azure. The following table summarises their common uses and management options.
(Refer to [Microsoft Graph group documentation](https://docs.microsoft.com/en-us/graph/api/resources/groups-overview?view=graph-rest-1.0) for details.)

| Group Type                       | Description                                | Mail Enabled | Security Enabled | API Management      |
| -------------------------------- | ------------------------------------------ | ------------ | ---------------- | ------------------- |
| **Microsoft 365 Groups**         | Collaboration groups with shared resources | ✔            | ✖                | Supported via Graph |
| **Security Groups**              | Access control for apps and resources      | ✖            | ✔                | Supported via Graph |
| **Mail-enabled Security Groups** | Access control with shared mailbox         | ✔            | ✔                | Not supported       |
| **Distribution Groups**          | Email distribution lists                   | ✔            | ✖                | Not supported       |

# Recommendations

- Manage traditional distribution groups on-premises and synchronise via  Microsoft Entra Connect where possible.
- Use Microsoft 365 Groups instead of legacy distribution groups for collaboration and email.
- Where required, Activate supports management of Azure-only distribution groups via Remote PowerShell.
- Avoid removing the final on-premises Exchange server if Microsoft Entra ID  synchronisation is in use.

# Maintenance and Updates

Azure and Microsoft Entra ID continue to evolve at a rapid pace. To ensure continued compatibility with Microsoft API changes and security updates, we recommended that organisations apply the latest Activate update every **6–9 months**.