Keeping an on-premise Active Directory (AD) domain rather than moving entirely to Microsoft Entra ID (formerly Azure AD) can still be justified for a mining company in several scenarios, especially when considering operational, security, and legacy infrastructure needs. Here’s a breakdown of why you’d retain an on-premise domain:

🔧 1. Legacy Applications and Systems Many mining environments still use legacy ERP, SCADA, or other operational systems that depend on traditional AD for authentication and cannot integrate directly with Entra ID. Old Windows services or servers using NTLM/Kerberos On-premise SQL Servers tied to domain accounts Equipment management software that…

🔧 1. Legacy Applications and Systems

Many mining environments still use legacy ERP, SCADA, or other operational systems that depend on traditional AD for authentication and cannot integrate directly with Entra ID.
Examples include:
- Old Windows services or servers using NTLM/Kerberos
- On-premise SQL Servers tied to domain accounts
- Equipment management software that doesn’t support modern auth

🛠️ 2. Industrial Control Systems (ICS) and OT Environment Integration

Operational Technology (OT) in mining sites may not be internet-facing and often relies on air-gapped or isolated domains.
Integrating Entra ID directly into these environments is risky or impractical due to:
- Limited or no cloud access from OT networks
- Strict regulatory requirements
- Need for real-time, local authentication with low-latency

🧰 3. Group Policy and Local Machine Management

Group Policy Objects (GPOs) are still only available via on-prem AD, not Entra ID.
This is crucial for:
- Controlling security settings
- Device configuration for domain-joined Windows machines
- Managing shared resources (e.g., file servers, print services)

🔐 4. Kerberos Authentication and Advanced Access Controls

Some mining systems require Kerberos authentication, which Entra ID does not support in the same way as AD.
On-premise AD allows for:
- Delegated authentication
- Fine-grained service account permissions
- Trust relationships between domains (for joint ventures, etc.)

🚧 5. Site Reliability and Offline Operation

Remote mining sites can suffer from limited or unreliable internet connectivity.
On-prem AD ensures:
- Continued user and service authentication during outages
- Access to local resources even if the cloud is unreachable
- Independence from cloud-based identity during network failure

🧾 6. Compliance, Audit, or Sovereignty Requirements

Some mining companies are subject to Australian data sovereignty, ISO, or other compliance requirements that mandate local identity controls.
On-prem AD supports:
- Centralized audit logging
- Custom security models aligned with internal policies
- Easier integration with local SIEM and compliance tools

🛤️ 7. Hybrid Model is Often the Best Fit

Most mining companies today operate in a hybrid identity model:
- On-prem AD + Entra ID via Entra Connect (Azure AD Connect)
- Use Entra ID for M365, SaaS apps, and mobile workers
- Retain AD for core infrastructure, OT, and reliability

Summary Table

Reason	On-Prem AD	Entra ID
Legacy apps support	✅	❌
GPO support	✅	❌
OT/ICS integration	✅	❌
Offline operations	✅	❌
Kerberos authentication	✅	❌
Modern cloud-based services	❌	✅
Mobile workforce & SaaS auth	❌	✅
Zero Trust & Conditional Access	❌	✅

If you’re modernising, the goal should be to minimize reliance on on-prem AD over time — but in mining, it’s rarely safe or practical to eliminate it entirely without a long and careful transition, especially in sites where uptime and legacy system integration are critical.

+ General

+ azure, cloud, cybersecurity, cybersecurity, microsoft, security