---
title: Identity and Infrastructure Deployment Models
slug: identity-and-infrastructure-deployment-models
createdAt: 2025-07-17T19:30:50.909Z
---

Activate’s deployment model is shaped by your organisation’s identity landscape, whether you operate in Azure, on-premises Active Directory, or a hybrid of both. Your chosen model defines the setup steps, dependencies, and required integrations.

# Overview

Each deployment model impacts the following areas:

- Active Directory Requirements and Permissions 
- Network Layout and Connectivity 
- Server Placement (Provisioning Server and Web) 
- SQL Database Location 
- Clustered or Single Server Configuration 
- Physical or Virtual Hosting (On-Premises or Cloud) 
- Certificates and Azure Applications 

# Deployment Models

Activate supports three main deployment models:

1. **Hybrid** 
2. **Cloud-Only** 
3. **On-Premises Only** 

Each model shares many components but differs in how authentication, data access, and service connectivity are implemented.

## Hybrid Deployment

The **Hybrid** model is the most common and aligns with Microsoft’s recommended enterprise architecture.  It integrates **on-premises Active Directory** with **Entra ID (AAD)** and **Office 365**, typically via **Azure AD Connect**.

### Requirements

- **Three Azure Application Registrations** 
  - **Orchestrator** – backend communication and provisioning 
  - **Login** – authentication for users and administrators 
  - **EOL Authentication** – connection to Exchange Online 
- **Two Certificates** 
  - One for the **website binding** and **Orchestrator communication** 
  - One for **EOL authentication** 
- **Service Accounts** 
  - **Orchestrator Service Account** 
  - **Web Service Account** 
- **Exchange Connectivity** 
  - Supports hybrid environments with on-premises and cloud Exchange mailboxes 

### Typical Use Case

Enterprises managing both on-premises and cloud workloads who require secure, low-latency communication between internal systems and Microsoft 365.

## Cloud-Only Deployment

The **Cloud-Only** model is suitable for organisations that have fully transitioned to Microsoft 365 and Azure AD without maintaining local Active Directory infrastructure.

### Requirements

- **Three Azure Application Registrations** 
  - **Orchestrator** 
  - **Login** 
  - **EOL Authentication** 
- **Two Certificates** 
  - One for **web binding** and **backend communication** 
  - One for **EOL authentication** 
- **Service Accounts** 
  - **Orchestrator Service Account** 
  - **Web Service Account** 

### Typical Use Case

Modern organisations operating exclusively in Microsoft 365 and Azure, where all identity and authentication is managed through Azure AD.

## On-Premises Only Deployment

The **On-Premises Only** model is for organisations with no dependency on cloud services. All components, including Active Directory and Exchange, remain within the internal network.

### Requirements

- **Three Application Registrations** 
  - **Orchestrator** 
  - **Login** 
- **One Certificate **for **web binding** and **backend communication** 
- **On-Premises Exchange** 
- **Service Accounts** 
  - **Orchestrator** 
  - **Web Service** 

### Typical Use Case

Highly secure or isolated environments that cannot connect to the cloud or have strict internal security controls.

#

### Maintenance

Because Microsoft frequently updates its cloud services, it is recommended to **patch Activate every 6–9 months** to maintain compatibility with Azure and Microsoft 365.

# Summary

| Deployment Model     | Typical Environment    | AD Dependency | Exchange        | Azure Integration | Best For                       |
| -------------------- | ---------------------- | ------------- | --------------- | ----------------- | ------------------------------ |
| **Hybrid**           | On-prem + Cloud        | AD + AAD      | Hybrid          | Yes               | Most enterprises               |
| **Cloud-Only**       | Fully in Microsoft 365 | AAD Only      | Exchange Online | Yes               | Modern cloud-native orgs       |
| **On-Premises Only** | Fully local            | AD Only       | On-prem         | No                | Isolated, high-security setups |