--- title: "Azure Active Directory Versus Identity Server - Muhammad Rehan Saeed" description: "A comparison between Azure Active Directory and Identity Server covering the advantages and disadvantages of both." canonical_url: "https://rehansaeed.com/azure-active-directory-versus-identity-server/" last_updated: "2016-05-20T00:00:00+00:00" meta: author: "Muhammad Rehan Saeed" keywords: "Active Directory,Azure Active Directory,Cloudflare,Connect Health,IdentityServer,IdentityServer4,Two-Factor Authentication" "og:description": "A comparison between Azure Active Directory and Identity Server covering the advantages and disadvantages of both." "og:image": "https://rehansaeed.com/_og/s/o_b8ae4ae0a59c9a5d.png" "og:image:alt": "Azure Active Directory Versus Identity Server - Muhammad Rehan Saeed" "og:image:height": "630" "og:image:type": image/png "og:image:width": "1200" "og:title": "Azure Active Directory Versus Identity Server" "twitter:image": "https://rehansaeed.com/_og/s/o_b8ae4ae0a59c9a5d.png" "twitter:image:alt": "Azure Active Directory Versus Identity Server - Muhammad Rehan Saeed" --- > Index of every page on this site: [llms.txt](https://rehansaeed.com/llms.txt) # [Azure Active Directory Versus Identity Server](https://rehansaeed.com/azure-active-directory-versus-identity-server/) Posted 20 May 2016 - **6 min read** ![Azure Active-Directory-Versus-Identity-Server](https://rehansaeed.com/_ipx/f_png&s_2560x1440/images/hero/Azure-Active-Directory-Versus-Identity-Server-1366x768.png) Disclaimer I looked into this subject for use by the company I work for, who had existing infrastructure I had to cater to, so the solution I chose is skewed in that direction. Even so I've tried to give an impartial summary of my own thoughts during my research. I originally asked this question on an Identity Server GitHub [issue](https://github.com/IdentityServer/IdentityServer3/issues/2116). # Azure Active Directory Link to this section Azure Active Directory is a hosted identity solution, so there is far less setup (especially if like me, you discover that to your surprise, you are already using it for Office 365). Out of the box, it provides some very nice features that can get you started very quickly. ## On-Premises Active Directory Link to this section Azure Active Directory can connect to an on-premises Active Directory server very easily using something called [Azure AD Connect](https://azure.microsoft.com/en-gb/documentation/articles/active-directory-aadconnect/). Most companies are not running everything in the cloud and have an on-premises AD server, so this is a pretty big killer feature. Syncing the two directories happens transparently but there are a bunch of things that can be configured like the way passwords are synced. I'm not a system administrator so I've not set this up personally but most IT admins can do this pretty painlessly. ## Connect Health Link to this section The premium edition of Azure Active Directory has a monitoring and reporting capability called [Connect Health](https://azure.microsoft.com/en-gb/documentation/articles/active-directory-aadconnect-health/) so you can see who is logging into your system and when. You can also get alerts for any seemingly nefarious activity, like a report on the top 50 users with failed username and password attempts, as well as a report on whether Azure AD is syncing correctly with any on-premises AD server you might have. It's a pretty nice feature for IT Admins, while others might not care too much about it. ![Azure Active Directory Connect Health](https://rehansaeed.com/_ipx/f_png&s_1564x1150/content-images/posts/2016/azure-active-directory-versus-identity-server/images/Azure-Active-Directory-Connect-Health.png) ## Two-Factor Authentication Link to this section The premium edition has two factor authentication built in right out of the box, so no having to setup a text message provider, plus the costs of sending those messages are included out of the box. ## Cloudflare for Identity Link to this section Microsoft is monitoring all logins and actively blocks activity from known attackers (a bit like cloudflare for identity), so it should in theory provide some added security. There is not much detail about this though. ## Managing Users Link to this section You can manage users from the Azure portal but the UI is just about passable. If you are using Office 365, you're in a better position as it provides a better UI to manage users. ## UI Customization Link to this section Customization of the UI is very basic. You can provide a company logo and background image, which get displayed on the login screens but that's about it. ## Developer Experience Link to this section The overall developer experience is pretty slick. Creating a new project in Visual Studio lets you enable integration with Azure AD by just logging in using your Azure credentials and selecting your Azure AD account. It doesn't get any easier than that for simple scenarios. For more complex scenarios, you will inevitably have to log into the Azure Portal and configure things a bit more. You often end up having to download and edit an XML configuration file from the Azure Portal. This is not the best experience in the world. ## Overall Link to this section You have to pay for the premium features and using the Azure Portal to do identity management is kind of a pain. Out of the box though this is ridiculously fast to setup and can get you up to speed very quickly, while giving you a secure platform. The documentation is pretty good and there are samples on GitHub with Microsoft developers actively monitoring the issues which was helpful. Some links I found useful: - [Documentation home page.](https://azure.microsoft.com/en-gb/documentation/articles/active-directory-whatis/) - [Documentation for each type of authentication flow.](https://azure.microsoft.com/en-gb/documentation/articles/active-directory-authentication-scenarios/) - [Samples covering every authentication flow.](https://azure.microsoft.com/en-gb/documentation/articles/active-directory-code-samples/#server-or-daemon-application-to-web-api) - Introduction [video 1 (Channel 9)](https://channel9.msdn.com/Shows/Azure-Friday/Azure-Identity-101-Vittorio-explains-Federation-and-the-basics-of-Azure-Active-Directory) and [video 2 (Channel 9)](https://channel9.msdn.com/Shows/Azure-Friday/Azure-Identity-102-Vittorio-creates-a-Windows-Azure-Active-Directory-in-Azure). - Build 2016 videos: - [Business-to-Consumer Identity Management with Azure Active Directory B2C](https://channel9.msdn.com/Events/Build/2016/P423) - Build 2015 videos: - [Azure Active Directory Identity Management as a Service for Modern Applications](https://azure.microsoft.com/en-gb/documentation/videos/build-2015-azure-active-directory-identity-management-as-a-service-for-modern-applications/) - [Develop Modern Web Applications with Azure Active Directory](https://azure.microsoft.com/en-gb/documentation/videos/build-2015-develop-modern-web-applications-with-azure-active-directory/) - [Develop Modern Native Applications with Azure Active Directory](https://azure.microsoft.com/en-gb/documentation/videos/build-2015-develop-modern-native-applications-with-azure-active-directory/) # IdentityServer Link to this section IdentityServer is the Swiss Army knife of Identity management. It can do everything but does require a small amount of setup and a little more knowledge of the identity space. It can do most things that I listed above and a lot more beyond. ## Multiple Identity Sources Link to this section IdentityServer can connect to one or more identity sources. It has to be noted that even if you are using Azure Active Directory, there may still be reasons for choosing IdentityServer which I had not initially considered. For example, if you have more than one source of user data e.g. You are using AD and also a SQL database of users, then IdentityServer can be used to point to both of these sources of user information. In theory it should also make it easier to switch from AD to something else entirely as it decouples things. ## Application Insights Link to this section It's possible to integrate Application Insights yourself and record things like logins and password resets. You could build a dashboard of graphs which looks like Connect Health. In fact, you can make it look exactly like Connect Health with very little effort. ## Two-Factor Authentication Link to this section Two-Factor Authentication requires a third party provider to send text messages and of course this means that there will be a monetary cost. In addition there is a small amount of code you have to write to get things connected. ## Use Cloudflare Link to this section Azure Active Directory provides some built in support for blocking malicious activity, a bit like Cloudflare but for identity. With IdentityServer, you could use the real Cloudflare and get some added protection for very little effort. ## UI Customization Link to this section UI customization is where IdentityServer shines. You have full access to the HTML and CSS and can fully customize the look and feel to your hearts content. ## Developer Experience Link to this section IdentityServer is built by [Dominick Baier](https://leastprivilege.com/), [Brock Allen](https://brockallen.com/) and the open source community. I actually did a WCF course under the instruction of Dominick many years ago and I can tell you that IdentityServer is in capable hands. Any questions or issues you have would be posted on the relevant [IdentityServer GitHub](https://github.com/IdentityServer) project. Dominick, Brock and other community members often answer questions. Overall, it's run as a healthy open source project. ## Microsoft Backing Link to this section Microsoft has attempted to build their own identity provider in the past but the solution wasn't the best. Having embraced open source, they now recommend IdentityServer themselves. ## Overall Link to this section The project is actively developed on GitHub and it has well known developers at the helm. There are code samples for all the authentication flows and you can get answers from the community. Some links I found useful: - [IdentityServer4 GitHub home page.](https://github.com/IdentityServer/IdentityServer4) - [Samples covering every authentication flow.](https://github.com/IdentityServer/IdentityServer4.Samples) - [IdentityManager GitHub home page](https://github.com/IdentityManager/IdentityManager) (A separate application for handling users, groups and roles). - [IdentityServer Admin GitHub home page](https://github.com/IdentityServer/IdentityServer3.Admin) (A tool for managing clients and scopes). - [Introduction video at NDC 2016 (Vimeo).](https://vimeo.com/154172925) # Authentication Flows Link to this section **Fact**: Security is really really hard. There are lots of different ways of doing authentication called 'flows'. I put [this link](https://azure.microsoft.com/en-gb/documentation/articles/active-directory-authentication-scenarios/) here because I found it very useful for understanding them. Also, the following diagram is key to understanding this entire topic. ![Authentication Flows](https://rehansaeed.com/_ipx/f_png&s_1582x680/content-images/posts/2016/azure-active-directory-versus-identity-server/images/Authentication-Flows.png) # Summary Link to this section What you decide to choose depends entirely on the problem you have. Which should you choose? Well, it depends on the number of developers, time, money and effort you can expend setting everything up. There is no one size fits all solution. Really, the differences in the two products above are the differences between a SaaS and PaaS solution. Which did I choose? While I was doing this research, I discovered to my surprise that the company I work for already had an Azure Active Directory linked to an on-premises Active Directory server because we were using Office 365. That made the choice much easier for us. ## Web Mentions [What's this?](https://en.wikipedia.org/wiki/Webmention) ### 0 Linked ### 0 Replies ## GitHub Comments ### 10 Comments [Comment on GitHub](https://github.com/RehanSaeed/rehansaeed.github.io/issues/59) [![RehanSaeed](https://avatars.githubusercontent.com/u/2270364?v=4)](https://github.com/RehanSaeed) ### [RehanSaeed](https://github.com/RehanSaeed) Owner 12 May 2020 [![coder1](https://camo.githubusercontent.com/b84381a789673f65540ebb7595d8a8f0bf19f60cd2bdfa5fc473488ccffdd1d8/68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f30323465333136643530663963366434613930306564353730356530303839643f733d393626643d6d6d26723d67)](https://camo.githubusercontent.com/b84381a789673f65540ebb7595d8a8f0bf19f60cd2bdfa5fc473488ccffdd1d8/68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f30323465333136643530663963366434613930306564353730356530303839643f733d393626643d6d6d26723d67) **coder1** commented on **2016-06-03 21:24:07** digital fonts used in headers are very strong and strain eyes which are already exhausted from programming and this might trigger migraine sometimes would u rather mind to try other font plzzz great post [![RehanSaeed](https://avatars.githubusercontent.com/u/2270364?v=4)](https://github.com/RehanSaeed) ### [RehanSaeed](https://github.com/RehanSaeed) Owner 12 May 2020 [![CodeGrue](https://camo.githubusercontent.com/066743b5cae041ce1ddf5fa8d1b8bab9f3a5e8647337b380eb8050cf66ed35a8/68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f39653564316633363134346362313839633134333262643763343230356231343f733d393626643d6d6d26723d67)](https://camo.githubusercontent.com/066743b5cae041ce1ddf5fa8d1b8bab9f3a5e8647337b380eb8050cf66ed35a8/68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f39653564316633363134346362313839633134333262643763343230356231343f733d393626643d6d6d26723d67) **CodeGrue** commented on **2016-12-19 20:21:25** Do you mean "Two-Factor" rather than "Two-Factory"? [![RehanSaeed](https://avatars.githubusercontent.com/u/2270364?v=4)](https://github.com/RehanSaeed) ### [RehanSaeed](https://github.com/RehanSaeed) Owner 12 May 2020 [![Muhammad Rehan Saeed](https://camo.githubusercontent.com/8a07049df41b8a3839a3f4342f09ea8e6e7fa0065667687f04beca2d088a1dca/68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f32623266393030653361633066353535316462646537323864336262343935343f733d393626643d6d6d26723d67)](https://camo.githubusercontent.com/8a07049df41b8a3839a3f4342f09ea8e6e7fa0065667687f04beca2d088a1dca/68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f32623266393030653361633066353535316462646537323864336262343935343f733d393626643d6d6d26723d67) **[Muhammad Rehan Saeed](https://rehansaeed.com/)** commented on **2016-12-21 09:05:49** > Do you mean "Two-Factor" rather than "Two-Factory"? Fixed. Thank you! [![RehanSaeed](https://avatars.githubusercontent.com/u/2270364?v=4)](https://github.com/RehanSaeed) ### [RehanSaeed](https://github.com/RehanSaeed) Owner 12 May 2020 [![arthur](https://camo.githubusercontent.com/4842d1b1760b8984ae9411a6bf3a85dcacf90b6443afdfd5f969fef390221c2b/68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f31656337356433633936303738663134373332626639353166313339643831623f733d393626643d6d6d26723d67)](https://camo.githubusercontent.com/4842d1b1760b8984ae9411a6bf3a85dcacf90b6443afdfd5f969fef390221c2b/68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f31656337356433633936303738663134373332626639353166313339643831623f733d393626643d6d6d26723d67) **arthur** commented on **2017-08-02 19:32:40** > digital fonts used in headers are very strong and strain eyes which are already exhausted from programming and this might trigger migraine sometimes > > would u rather mind to try other font plzzz > > great post i'll have to agree with that. [![RehanSaeed](https://avatars.githubusercontent.com/u/2270364?v=4)](https://github.com/RehanSaeed) ### [RehanSaeed](https://github.com/RehanSaeed) Owner 12 May 2020 [![Neil Billingham](https://camo.githubusercontent.com/2e532b020353b3159533c2460ef6a40e7ede4468833bd3ca26e1b98f1f38ad5b/68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f39336332316437383665343762613131636634663537363930306464386465313f733d393626643d6d6d26723d67)](https://camo.githubusercontent.com/2e532b020353b3159533c2460ef6a40e7ede4468833bd3ca26e1b98f1f38ad5b/68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f39336332316437383665343762613131636634663537363930306464386465313f733d393626643d6d6d26723d67) **Neil Billingham** commented on **2017-10-27 16:54:48** Hi, thanks for the post; do you have any references mentioning Microsoft''s backing for Identity Server? [![RehanSaeed](https://avatars.githubusercontent.com/u/2270364?v=4)](https://github.com/RehanSaeed) ### [RehanSaeed](https://github.com/RehanSaeed) Owner 12 May 2020 [![Muhammad Rehan Saeed](https://camo.githubusercontent.com/8a07049df41b8a3839a3f4342f09ea8e6e7fa0065667687f04beca2d088a1dca/68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f32623266393030653361633066353535316462646537323864336262343935343f733d393626643d6d6d26723d67)](https://camo.githubusercontent.com/8a07049df41b8a3839a3f4342f09ea8e6e7fa0065667687f04beca2d088a1dca/68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f32623266393030653361633066353535316462646537323864336262343935343f733d393626643d6d6d26723d67) **[Muhammad Rehan Saeed](https://rehansaeed.com/)** commented on **2017-11-13 09:14:35** > Hi, thanks for the post; do you have any references mentioning Microsoft''s backing for Identity Server? If you've ever seen the ASP.NET Community Standup, this question has come up a couple of times and Damian Edwards has supported the use of Identity Server in this scenario. I'm not sure there is an online statement supporting this fact, of course Microsoft has their own competing product in Azure AD, so I'm not sure there would be anything overtly advertising IdentityServer. [![RehanSaeed](https://avatars.githubusercontent.com/u/2270364?v=4)](https://github.com/RehanSaeed) ### [RehanSaeed](https://github.com/RehanSaeed) Owner 12 May 2020 [![Alex](https://camo.githubusercontent.com/358524f82442031ec47703e509ea48ddf9ec4c686bde58b53e1934f8dd6f56d5/68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f62303631613863343034323136363139636436616538393935656337343563303f733d393626643d6d6d26723d67)](https://camo.githubusercontent.com/358524f82442031ec47703e509ea48ddf9ec4c686bde58b53e1934f8dd6f56d5/68747470733a2f2f7777772e67726176617461722e636f6d2f6176617461722f62303631613863343034323136363139636436616538393935656337343563303f733d393626643d6d6d26723d67) **[Alex](http://-/)** commented on **2017-12-15 09:53:14** It seems that Scott Hanselman is promoting IdentityServer: [https://mva.microsoft.com/en-us/training-courses/introduction-to-identityserver-for-aspnet-core-17945?l=oygMZtBPE\_5806218965](https://mva.microsoft.com/en-us/training-courses/introduction-to-identityserver-for-aspnet-core-17945?l=oygMZtBPE_5806218965) [![xperiandri](https://avatars.githubusercontent.com/u/2365592?v=4)](https://github.com/xperiandri) ### [xperiandri](https://github.com/xperiandri) 26 May 2020 Isn't IdentityServer overcomplicated? I've chosen OpenIddict when looked for OpenID Connect server solution because I was not managed to figure out anything in Identity Server samples and it was not flexible enough with storing info. It didn't allow Guids instead of ints on top of Entity Framework Core [![RehanSaeed](https://avatars.githubusercontent.com/u/2270364?v=4)](https://github.com/RehanSaeed) ### [RehanSaeed](https://github.com/RehanSaeed) Owner 26 May 2020 > Isn't IdentityServer overcomplicated? I've chosen OpenIddict when looked for OpenID Connect server solution because I was not managed to figure out anything in Identity Server samples and it was not flexible enough with storing info. It didn't allow Guids instead of ints on top of Entity Framework Core I haven't tried OpenIddict. I think of IdentityServer as a swiss army knife that can be configured to do most things. I believe it can be used to store GUID's. The default EF Core code just uses int's. [![xperiandri](https://avatars.githubusercontent.com/u/2365592?v=4)](https://github.com/xperiandri) ### [xperiandri](https://github.com/xperiandri) 27 May 2020 https://github.com/IdentityServer/IdentityServer4/blob/768a0386408f4b85376d2d9a7156deceb9931f56/src/EntityFramework.Storage/src/Entities/Client.cs#L15 ```json {"@context":"https://schema.org","@graph":[{"@id":"https://rehansaeed.com/#website","@type":"WebSite","description":"Software Developer at Microsoft, YouTuber, Open Source Contributor and Blogger","inLanguage":"en-GB","name":"Muhammad Rehan Saeed","url":"https://rehansaeed.com/","author":{"@id":"https://rehansaeed.com/#identity"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://rehansaeed.com/?search={search_term_string}"},"query-input":"required name=search_term_string"}],"publisher":{"@id":"https://rehansaeed.com/#publisher"}},{"@id":"https://rehansaeed.com/azure-active-directory-versus-identity-server/#webpage","@type":"WebPage","dateModified":"2016-05-20T00:00:00+00:00","datePublished":"2016-05-20T00:00:00+00:00","description":"A comparison between Azure Active Directory and Identity Server covering the advantages and disadvantages of both.","name":"Azure Active Directory Versus Identity Server","url":"https://rehansaeed.com/azure-active-directory-versus-identity-server/","breadcrumb":{"@id":"https://rehansaeed.com/azure-active-directory-versus-identity-server/#breadcrumb"},"isPartOf":{"@id":"https://rehansaeed.com/#website"},"potentialAction":[{"@type":"ReadAction","target":["https://rehansaeed.com/azure-active-directory-versus-identity-server/"]}]},{"@id":"https://rehansaeed.com/#identity","@type":"Person","name":"Muhammad Rehan Saeed","url":"https://rehansaeed.com/about/","image":{"@id":"https://rehansaeed.com/#/schema/image/1"},"sameAs":["https://github.com/RehanSaeed","https://www.linkedin.com/in/muhammad-rehan-saeed","https://stackoverflow.com/users/1212017/muhammad-rehan-saeed","https://www.youtube.com/c/MuhammadRehanSaeed","https://www.twitch.tv/rehansaeeduk"]},{"@id":"https://rehansaeed.com/#publisher","@type":"Organization","logo":"https://rehansaeed.com/images/schema/Publisher-600x60.png","name":"Muhammad Rehan Saeed","url":"https://rehansaeed.com"},{"@id":"https://rehansaeed.com/azure-active-directory-versus-identity-server/#article","@type":"Article","dateModified":"2016-05-20T00:00:00+00:00","datePublished":"2016-05-20T00:00:00+00:00","description":"A comparison between Azure Active Directory and Identity Server covering the advantages and disadvantages of both.","headline":"Azure Active Directory Versus Identity Server","inLanguage":"en-GB","url":"https://rehansaeed.com/azure-active-directory-versus-identity-server/","author":{"@id":"https://rehansaeed.com/#identity"},"image":[{"@type":"ImageObject","url":"https://rehansaeed.com/images/hero/Azure-Active-Directory-Versus-Identity-Server-1366x768.png","caption":"Azure Active-Directory-Versus-Identity-Server","width":"1366","height":"768"}],"isPartOf":{"@id":"https://rehansaeed.com/azure-active-directory-versus-identity-server/#webpage"},"keywords":["Active Directory","Azure Active Directory","Cloudflare","Connect Health","IdentityServer","IdentityServer4","Two-Factor Authentication"],"mainEntityOfPage":{"@id":"https://rehansaeed.com/azure-active-directory-versus-identity-server/#webpage"},"publisher":{"@id":"https://rehansaeed.com/#publisher"}},{"@id":"https://rehansaeed.com/azure-active-directory-versus-identity-server/#breadcrumb","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","name":"Blog","item":"https://rehansaeed.com/","position":1},{"@type":"ListItem","name":"Azure Active Directory Versus Identity Server","item":"https://rehansaeed.com/azure-active-directory-versus-identity-server/","position":2}]},{"@id":"https://rehansaeed.com/#/schema/image/1","@type":"ImageObject","contentUrl":"https://rehansaeed.com/images/author/Muhammad-Rehan-Saeed/Logo-512x512.png","inLanguage":"en-GB","url":"https://rehansaeed.com/images/author/Muhammad-Rehan-Saeed/Logo-512x512.png"}]} ``` ## Sitemap See the full [sitemap](https://rehansaeed.com/sitemap.md) for all pages.