Can I replace Windows Server 2012 (AD) with Azure?

Question

I have a small business with about 10 PC's (plus Android devices and other kit that attaches to the network). I really enjoy doing my own IT and although I'm not an IT professional, manage my own network with Windows Server 2012 Essentials.

This has been great generally, but I'm now much busier with the actual business side of things and unfortunately do not have the time to deal with server management, specifically AD. Our main management software uses SQL server.

My questions are:

1. Could the AD part of our network management be taken care of by Azure with no additional infrastructure (i.e. do I actually understand what Azure is for)?
2. If we did this, could I still store our SQL server on our local Windows Server?

I appreciate that the answer could be "well hire an IT manager, then", but we really are a small business with 10 employees and network management work is extremely sporadic.

Thanks in advance, Adam

Answer 1

Azure Active Directory isn't really a replacement for on-premise Active Directory. It's more meant to extend your on-premise Active Directory to allow you to use Office 365 (or other Azure based service).

There is an Active Directory Directory Services in preview, but even that doesn't really replace an on-premise Active Directory, it's more designed to provide Active Directory services to your Azure VMs.

Neither of the two options would allow you to join a workstation to the domain, so it would complicate rather than simplify what you currently have.

I'm guessing you'll also be using your Windows Server 2012 server for DHCP which couldn't be replaced with an Azure solution (although a switch/router may be able to do it)

Answer 2

If you don't care where is your AD stored at, then yes, you could use it as a server for your office. What you'll need is a fix IP address to the server, likely a VPN tunnel as well. between the clients and the server.

And yes, you can store your database locally if you can configure your firewall to forward the Azures traffic to the MySQL server if the traffic is regarding to a database. Or even better, use a seperate IP address for the database server only.

I'm very against this method because it brings up so many security issues for the future that can't be fixed by mere IT Administrators, I think. For that, you'll net an ethical hacker maybe, or a SysAdmin who is very trained in security policies.