Customer identity, directories & app access
AWS Directory Service vs Microsoft Entra Domain Services
AWS Directory Service maps to Microsoft Entra Domain Services.
Both provide managed domain join, Group Policy, LDAP, and Kerberos or NTLM authentication.
Side-by-side comparison
| Aspect | Amazon Web Services | Microsoft Azure |
|---|---|---|
| Service | AWS Directory Service | Microsoft Entra Domain Services |
| Lifecycle | Generally available | Generally available |
| What it is | AWS Managed Microsoft AD (real Windows Server AD run by AWS, with trusts to on-premises AD), AD Connector (a proxy to your AD), and Simple AD (Samba-based). | Managed domain (domain join, Group Policy, LDAP, Kerberos and NTLM) synced from Entra ID, without deploying domain controllers. |
| Pricing model | Per directory-hour by edition (Standard or Enterprise for Managed Microsoft AD), and per AD Connector-hour. | Per hour by SKU (Standard, Enterprise, Premium). |
| Docs | AWS Directory Service docs | Microsoft Entra Domain Services docs |
| Pricing page | AWS Directory Service pricing | Microsoft Entra Domain Services pricing |
| Exams | SAA-C03 SAP-C02 Retiring | AZ-104 SC-300 |
Key differences
- Source of identities. AWS Managed Microsoft AD is a real AD forest you administer (with delegated admin rights), and it can create trusts with on-premises AD. Entra Domain Services is a standalone managed domain whose users sync one way from Entra ID, with limited admin rights. You can configure forest trusts with on-premises AD DS for hybrid access.
- Proxy. AD Connector proxies requests to your existing AD with no cloud directory. On Azure, the equivalent pattern is to run your own domain controllers on Azure VMs, or use Entra Connect to sync identities.
Pricing summary
Pricing models only. No prices are quoted because they change by region and over time.
- AWS
- Per directory-hour by edition (Standard or Enterprise for Managed Microsoft AD), and per AD Connector-hour. AWS Directory Service pricing →
- Azure
- Per hour by SKU (Standard, Enterprise, Premium). Microsoft Entra Domain Services pricing →
Certification exam mapping
| Exam | Provider | Level | Status |
|---|---|---|---|
| AWS Certified Solutions Architect – Associate SAA-C03 | AWS | Associate | current Italian version retires after Dec 31, 2026. |
| AWS Certified Solutions Architect – Professional SAP-C02 | AWS | Professional | retiring Being updated to SAP-C03. Registration for SAP-C03 opens Oct 27, 2026. Last day to take SAP-C02 is Nov 16, 2026. |
| Microsoft Certified – Azure Administrator Associate AZ-104 | Azure | Associate | current |
| Microsoft Certified – Identity and Access Administrator Associate SC-300 | Azure | Associate | current English version will be updated on Oct 28, 2026. |
Relevance is based on each exam's published scope, not a line-by-line objective match. Check the official study guide.
FAQ
What is the Azure equivalent of AWS Directory Service?
AWS Directory Service maps to Microsoft Entra Domain Services. Both provide managed domain join, Group Policy, LDAP, and Kerberos or NTLM authentication.
How does pricing compare between AWS Directory Service and Microsoft Entra Domain Services?
AWS: Per directory-hour by edition (Standard or Enterprise for Managed Microsoft AD), and per AD Connector-hour. Azure: Per hour by SKU (Standard, Enterprise, Premium). Check the official pricing pages for current rates.
Which certification exams cover this topic?
AWS Certified Solutions Architect – Associate (SAA-C03); AWS Certified Solutions Architect – Professional (SAP-C02) [retiring]; Microsoft Certified – Azure Administrator Associate (AZ-104); Microsoft Certified – Identity and Access Administrator Associate (SC-300).