How to migrate apps which has NTLM, Kerberos and LDAP integrated on on-premises environments to Entra ID and what all things we need to take care of so that we dont loose apps access and configurations as well?

Question

How to migrate apps which has NTLM, Kerberos and LDAP integrated on on-premises environments to Entra ID and what all things we need to take care of so that we don't loose apps access and configurations as well?

Answer 1

Hi @Mytoast Admin ,

Thanks for reaching out, and posting your question in Q&A. Migration of an app to Entra ID based authentication is never a 'one size fits all' thing. Each application has it particularities and these should be considered in detail before choosing the right migration strategy. However, in general you can use the following as reference...

For NTLM/Kerberos-based Apps

Option 1: Azure AD Kerberos (Hybrid Kerberos Authentication)

• Azure AD Kerberos allows cloud authentication for apps that still rely on Kerberos.
• Requires Hybrid AD Join for devices.

Option 2: Modern Authentication (Preferred)

• Migrate apps to Entra ID authentication using OAuth 2.0, OpenID Connect, or SAML.
• Configure Entra ID Application Proxy if the app must remain on-prem but needs modern auth.

Option 3: Use Windows 365 or Azure Virtual Desktop

• If the app cannot be modernized but still needs on-prem access, use Cloud PCs.

B. For LDAP-based Apps

Option 1: Azure AD DS (Managed Domain Services)

• Azure AD DS provides LDAP, Kerberos, and NTLM support in the cloud.
• Requires synchronization with Entra ID.

Option 2: Modern Authentication

• Replace LDAP authentication with Azure AD authentication via OAuth 2.0/SAML.
• Consider using Microsoft Graph API for directory queries instead of direct LDAP calls.

As usual, if this answers your question, do click Accept Answer and Yes for what if this answer was helpful. And, if you have any further queries do let us know. 

Cheers