Many Polish SMEs are in exactly the same spot: a Windows Server sits under a desk, running an Active Directory from 2015, while everything except workstation login has long since moved to Microsoft 365. The server goes out of support next year, renewing the CALs costs as much as a new laptop, and every update happens on a Friday evening. The question we hear once a week: "do we actually have to replace that box, or can we just turn it off?"
The answer isn't ideological. Not every SME benefits from a pure-cloud identity today, and not every SME should keep AD DS running for another five years. It depends on what your domain controller actually does — and most owners have never had a reason to check. This piece is about how to work that out without hype.
What your domain controller actually does
Before you decide whether to switch AD off, you need to know what it's currently doing. In a typical 30-person trading or manufacturing company the list is shorter than it feels:
- Workstation login (Kerberos authentication).
- Group policies (GPO) — mapped network drives, printer settings, password policies.
- Authentication to file shares hosted on the same server.
- Authorization in the ERP or line-of-business app ("sign in with your domain account").
- Authentication to the office MFP or scan-to-email device.
Usually one of two things comes out. Either half of the list is already in the cloud (files in SharePoint, mail in Exchange Online) and AD is only holding workstation login — or AD really is the backbone for an ERP and warehouse system running on Kerberos.
The difference between those two scenarios is huge. The first can normally be moved to Entra ID + Intune inside a quarter and the server decommissioned. The second means a hybrid for the next 2–3 years, until either your ERP changes or the vendor adds OAuth/SAML authentication.
What Entra ID replaces without compromise
Entra ID (formerly Azure AD), in the version included with Microsoft 365 Business Premium, replaces AD DS in most of the "soft" scenarios:
- Laptop login — Windows 10/11 in Microsoft Entra joined mode signs in with a cloud identity and works fully without a domain controller on the LAN.
- MFA and Conditional Access — sign-in restricted to trusted devices, from Poland, in working hours, per application. Classic GPO can't do this.
- SSO to M365, Teams, SharePoint, and to essentially every modern SaaS (Salesforce, HubSpot, Slack, GitHub, Autenti, Comarch cloud modules).
- Access groups — the same groups drive SharePoint, SaaS entitlements, and Intune permissions.
- Automatic offboarding — an account disabled in M365 disappears from every integrated system, without anyone having to remember "where else he had a login".
Add Intune — the cloud replacement for GPO on laptops. Not everything from GPO has an Intune equivalent (more on that in a moment), but around 80% of a typical SME's policy set moves across without drama: BitLocker, screen lock, Wi-Fi/VPN config, USB restrictions, enforced Windows Update.
What Entra ID won't replace one-to-one
If someone is selling you the migration as "we just switch the server off", it's worth asking about specific cases. Typical friction points in an SME:
- ERPs that rely on Kerberos/NTLM — older Comarch XL, Microsoft Dynamics AX 2012, custom .NET apps whose service pools run under a domain account. Without AD they simply won't authenticate. The fix: a hybrid with Entra Connect Sync, or an ERP migration down the line.
- SMB file servers — if you host hundreds of gigabytes of CAD drawings or scanned accounting documents, moving to SharePoint is often unworkable (path length limits, versioning, cost). The alternative is Azure Files with Entra Kerberos authentication — but that's a hybrid architecture, not a pure-cloud one.
- Print queues on a print server — older Kyocera/Sharp/Konica MFPs have been squeezed out of network printing after PrintNightmare. Universal Print works, but it needs newer drivers and its own license.
- Line-of-business apps asking for a "domain" — CAM tools, LIMS, time-attendance and access-control systems. Even in 2026 a large share of them still can't do OAuth. Ask the vendor in writing before you plan to unplug the DC.
- Classic GPO features Intune doesn't have — PowerShell-driven drive mappings, IP-attached local printers, Outlook configuration via a .PRF file. You can rebuild these in Intune, but it isn't one click.
A migration path that doesn't break the company
We don't recommend "big bang" cutovers over a weekend. In nine projects out of ten it looks like three stages:
- Hybrid. Install Entra Connect Sync so local AD accounts land in the cloud. Users still sign in the same way, but MFA and SSO work immediately.
- Cloud-first for new laptops. Every new device is Entra joined, provisioned via Autopilot, managed by Intune. Old laptops stay on AD until natural replacement.
- Retire the DC. Once 80–90% of workstations are Entra joined, the last apps are on OAuth/SAML, and file shares live in SharePoint or Azure Files — power the DC off, snapshot it, and archive for three years, just in case.
For a 30-person company this typically takes 12–18 months. Not because the work is hard, but because the pace is set by laptop refresh cycles and by line-of-business vendors' release schedules.
A real example — a 35-person distribution company
Over the winter of 2025/2026 we ran this migration at a 35-person distribution company near Poznań. Starting point: Windows Server 2016 going EOL in January 2027, Server Standard + 35× CAL renewals quoted by their reseller at PLN 22,000 (~EUR 5,100), M365 Business Premium already in place for two years, and Comarch Optima ERP on a separate server with SQL Express.
We did three things. First, an audit: AD was only holding workstation login and two mapped drives whose contents had long since been copied into SharePoint (with incomplete sync). Second, a plan: new laptops via Autopilot, Intune replacing GPO, mapped drives retired after finishing the SharePoint migration with native permissions. Third, execution over 4 months, at weekends, with zero days of downtime.
Result: the domain controller was powered off in April, roughly PLN 22,000 saved on licenses that never had to be renewed, around 6 hours a month less work for the external administrator (his bill dropped by about 30%), and — most importantly for the client — no more Friday-evening "nobody can log in because the box in the cupboard died".
When to stay on AD
Anti-hype: not every SME should switch now. It's worth staying on AD DS for another year or two if:
- Your critical system (ERP, CAM, LIMS) requires AD authentication and the vendor has no Entra roadmap.
- You host a large file corpus (2 TB+) that SharePoint can't sensibly handle, and Azure Files doesn't fit the budget.
- The company is in the middle of another migration (ERP, WMS) and identity would be the third change at once — a proven recipe for chaos.
- You have production workstations on Windows LTSC or older terminals that simply can't be Entra joined this year.
In those cases it's better to renew the server, wait a year or two, and revisit Entra on the natural hardware refresh cycle.
Where to start
Before you cost the licenses and hardware, spend one day on an audit: what actually authenticates against AD. Open Event Viewer on the DC, check the Kerberos logs, export the GPO list, and ask each department head what they "have in the domain". Eight times out of ten the list is half of what people think it is, and the decision gets easier.
If you'd like to run this with someone who won't sell you licenses you don't need, talk to us. The first call is free, takes 30 minutes, and you walk away with a concrete list — not with a quote.
Entra ID doesn't replace AD in every company. It replaces it where AD no longer does anything more important than log in a laptop.