Skip to content
Deepak Gupta markTech Graveyard

Tech Graveyard/infrastructure

On-Prem Active Directory (1999 to Zombie)

Active Directory is the most successful piece of enterprise software that nobody chooses anymore. It is the primary directory at an estimated 90% of the Fortune 1000, and almost no new deployments.

Born 1999 · Still undead, projected end 2032 · Status: zombie

By Deepak Gupta · Published · Last updated

Paired prediction: what replaces it in Future Tech

Certificate of Death

Name of decedent

On-Prem Active Directory

Born
1999
Died
Not yet
Age
27+

Cause of death

Remote work and SaaS adoption made the on-prem domain controller indefensible

Survived by

Microsoft Entra ID, Okta, JumpCloud, Google Workspace

Invented by

Microsoft's Windows 2000 Server team

Status: ZombieProjected final breath: 2032

Filed by D. Gupta · guptadeepak.com

The hook

I have not seen a new on-prem Active Directory deployment win a competitive bake-off since 2022. Frost & Sullivan estimated AD is the primary directory at about 90% of the Global Fortune 1000. Both statements are true.

Thesis. Active Directory is not fading from a feature gap. It is fading from a model gap. The 'trusted network' it was designed to protect does not exist anymore.

The story

The origin

Windows 2000 launch, February 2000. AD replaced NT domains, brought hierarchical organization, and became the spine of enterprise IT for the next two decades. Every employee, every laptop, every printer, every login.

The peak

2015 to 2018. AD was the moat around the enterprise. Group Policy, Kerberos tickets, LDAP queries, the works. The infrastructure team that ran AD was the most important team in IT.

The first crack

2020 pandemic. Tens of millions of office workers left the corporate network almost overnight. AD's perimeter assumption broke. The 'inside the firewall' state stopped being a thing for most knowledge workers.

The Microsoft pivot

Microsoft's identity guidance now points cloud-first organizations to Entra ID. The rename from Azure AD to Microsoft Entra ID, announced in July 2023, was the strategic signal: cloud is the direction.

The zombie state

Too expensive to migrate, too risky to leave. Hybrid configurations multiply. The hard part is not the directory but the hundreds of apps bound to LDAP and Kerberos. For a large enterprise that is a multiyear project that delivers no new features, only risk reduction.

Key data points

  • Windows 2000 launch (with AD): February 2000
  • Global Fortune 1000 using AD as primary directory: about 90% (Frost & Sullivan estimate)
  • Microsoft Entra ID rebrand from Azure AD: July 2023
  • Notable holdouts: government, defense, regulated finance

Contrarian angle

Microsoft's most profitable product in the next decade may be helping enterprises migrate away from Microsoft's most successful product of the last decade.

The flip side

What replaces it

The paired prediction in Future Tech.

Read the prediction

◆ Technology Rewired

See the full evolution in Technology Rewired:

FAQ

Is Entra ID just AD in the cloud?

No. Entra ID is a different identity model entirely (OAuth, OIDC, SCIM) running in Microsoft's cloud. It can sync with on-prem AD via Entra Connect, but the architecture and protocol surface are different.

Why can't enterprises just retire AD?

Legacy applications. Most large enterprises have hundreds of internal apps that authenticate to AD via LDAP or Kerberos. Migrating those is the actual project; the directory swap is the easy part.

What's the security risk of running AD in 2026?

AD's privilege model (domain admin = god) is incompatible with modern least-privilege architectures. Every major ransomware playbook includes 'compromise the domain controller.' The risk is structural, not patchable.

More from guptadeepak.com

Further reading

Related obituaries

More from the infrastructure graveyard.