I’ve been working full time in IT for about 3.5 years, and a consistent theme across those years has been “cloud cloud cloud cloud.” It gets friggin exhausting. Moving to the cloud costs more on the OpEx side than people expect, and coordinating a lift-and-shift off on-premises reliance is an absolute nightmare. So no, I’m not anti-cloud. I’m anti-“cloud-first” as a slogan.
I ultimately believe folks have too much dip on their chip. They’re trying to move everything at once. They say “we need to be cloud-first” when they should be saying “we need to be cloud-native in our thinking.” Cloud-first is about where your workloads live. Cloud-native thinking is about where you control them from.
Through repeated failures and plenty of conversations with the WinAdmins community, I’ve found that we’re often asking the wrong question. “Why can’t we move this workload to the cloud?” is too much of a lift for most orgs, both technically and culturally (more on the culture side in a later post). I’ve had a lot more success reframing it as “what’s stopping us from moving the management plane?” Kind of an “if we build it, they’ll come” approach.
The management plane is wherever you control things from. For identity, that’s been Active Directory for 25 years: managing it means line-of-sight to a domain controller, and security is often bolted on after the fact (if everyone’s a domain admin, is anyone actually privileged?). Moving that plane to Entra means managing those identities from a portal you can reach from anywhere, gated by Conditional Access, PIM, and the other security features that come native with most Microsoft 365 plans instead of by network line-of-sight.
Our move to cloud-native devices is another good example. Severing the inherent trust relationship with Active Directory meant things like device certs no longer coming from ADCS, but on-prem resource access didn’t suffer, so did we really lose anything? (Omg, is Active Directory going away?)
I started this blog because I talk to myself too much, and I figured I could talk into the void instead and maybe help someone. I’ll be writing about the things I’m working on and the new features I’m testing, at work and in my free time, with the goal of reframing some poorly approached questions and getting our orgs a little closer to secure and (one day) cloud-native.
Welcome to Active Directory Is Dead. I’m your host, Beau, and I’m here to kill Active Directory.
P.S. If you need proof I’m not crazy, this is worth a look.