The Free edition of Azure Active Directory is part of every Azure subscription. There is nothing to license and nothing to install. With it, you can manage user accounts, synchronise with on-premises directories, get single sign-on across Azure, Office 365, and thousands of popular SaaS applications like Salesforce, Google Apps, ServiceNow, Dropbox, etc.
Azure AD premium is what you will need for password self service in the cloud and AD write back.
The Microsoft Enterprise Mobility Suite (EMS) discount makes it the most cost-effective way to acquire the included cloud services:
- Microsoft Azure Active Directory Premium for hybrid identity management, Microsoft Intune and Microsoft Azure Rights Management for information protection
| Features | Free edition | Basic edition | Premium edition |
| Directory as a service | Up to 500K objects | No object limit | No object limit |
| User and group management using UI or Windows PowerShell cmdlets | Tick | Tick | Tick |
| Device registration | Tick | Tick | Tick |
| Access Panel portal for SSO-based user access to SaaS and custom applications | Tick Up to 10 apps per user | Tick Up to 10 apps per user | No app limit |
| User-based application access management and provisioning | Tick | Tick | Tick |
| Self-service password change for cloud users | Tick | Tick | Tick |
| Azure AD Connect – For syncing between on-premises directories and Azure Active Directory | Tick | Tick | Tick |
| Standard security reports | Tick | Tick | Tick |
| Features | Basic edition | Premium edition | |
| High availability SLA uptime (99.9%) | Tick | Tick | |
| Group-based application access management and provisioning | Tick | Tick | |
| Customisation logo and colours to the Sign In and Access Panel pages | Tick | Tick | |
| Self-service password reset for cloud users | Tick | Tick | |
| Application Proxy: Secure Remote Access and SSO to on-premises web applications | Tick | Tick | |
| Features |
|
| Premium edition |
| Advanced application usage reporting | Tick | ||
| Self-service group management for cloud users | Tick | ||
| Self-service password reset with on-premises write-back | Tick | ||
| Microsoft Identity Manager (MIM) user licenses – For on-premises identity and access management | Tick | ||
| Advanced anomaly security reports (machine learning-based) | Tick | ||
| Cloud app discovery | Tick | ||
| Multi-Factor Authentication service for cloud users | Tick | ||
| Multi-Factor Authentication server for on-premises users | Tick |
Multi-Factor Authentication is included with Premium and can secure access to on-premises applications (VPN, RADIUS, etc.), Azure, Microsoft Online Services like Office 365 etc.
Microsoft Identity Manager (MIM) - Premium comes with the option to grant rights to use a MIM server (and CALs) in your on-premises network to support any combination of Hybrid Identity solutions. This is a great option if you have a variation of on-premises directories and databases that you want to sync directly to Azure Active Directory. There is no limit on the number of FIM servers you can use, however, MIM CALs are granted based on the allocation of an Azure.
Note, if you have SSPR on prem too?
Q: Can I synchronise data for security questions from on premises?
A: No, this is not possible today, but Microsoft are considering it.
Note2, locked out account?
Q: Do you unlock the local active directory accounts when users reset their passwords?
A: Yes, when a user resets his or her password and password writeback has been deployed with versions of AADSync 1.0.0485.0222 or later, then that user’s account will be automatically unlocked when that user resets his or her password.
Note3 & 4, worries about hackerz?
Q: Do you prevent users from attempting password reset many times in a short time period?
A: Yes, Users may only try 5 password reset attempts within an hour before being locked out for 24 hours. Users may only try to validate a phone number 5 times within an hour before being locked out for 24 hours. Users may only try a single authentication method 5 times within an hour before being locked out for 24 hours.
Q: For how long are the email and SMS one-time passcode valid?
A: The session lifetime for password reset is 105 minutes. This means that from the beginning of the password reset operation, the user has 105 minutes to reset his or her password. The email and SMS one-time passcode are invalid after this time period expires.
Azure AD versions: https://msdn.microsoft.com/en-us/library/azure/dn532272.aspx
Azure AD Password writeback: https://msdn.microsoft.com/en-us/library/azure/dn903642.aspx
Setting up SSRP: https://msdn.microsoft.com/en-us/library/azure/dn683881.aspx
