Directory Service Coming to Azure

A cloud-based directory service derived from Active Directory (AD) is coming to the Windows Azure platform. The service, branded Windows Azure Active Directory (WAAD), was originally developed and deployed to manage user identities for Office 365. It is now also used by the Windows Intune PC management service and will be used by other Microsoft products such as Dynamics CRM Online. A developer preview will open WAAD to third parties, helping cloud-based applications achieve single-sign-on user access and relieving developers from implementing directory services within applications. Azure’s Access Control service, which lets applications use external identity providers, continues, now under the WAAD brand.

AD-Based Directory Originally Built for Office 365

Office 365, which offers customers Exchange, SharePoint, Lync, and Office applications through a Microsoft-hosted online service, required Microsoft to build a cloud-based directory service to perform AD duties. Office 365 could not depend on customers’ on-premises AD deployments due to connectivity (for example, across firewalls) and performance issues, and some customers do not have AD deployments. Microsoft derived the design of Office 365’s directory service from AD, but with greater scalability, with the intention of opening that service to other Microsoft products and eventually third-party products through WAAD. On-premises AD deployments can be synchronized and federated (using Active Directory Federation Services) with WAAD. Federation enables single-sign-on for access to applications using AD or WAAD.