Christchurch · Dunedin · Nationwide
Active Directory and Microsoft Entra ID Management
Exodesk provides Active Directory management and Microsoft Entra ID administration for New Zealand businesses. Our Christchurch and Dunedin teams keep accounts, groups and agreed access changes aligned with your team.
Ongoing, co-managed or one-off work, whether or not Exodesk manages your wider IT. We agree which systems we manage, who approves changes and how requests reach us.
Supporting New Zealand businesses since 1989
The short answer
What is Active Directory management?
Active Directory management is the ongoing administration of accounts, groups and applicable directory policies, so access matches the people and systems your business has today.
For Active Directory Domain Services (AD DS), that includes Windows domain settings and Group Policy. For Microsoft Entra ID, it covers cloud identities, groups and sign-in settings for Microsoft 365 and connected applications. The scope states whether related server health, synchronisation and recovery work are also covered.
Exodesk has supported New Zealand businesses since 1989. Today, our Christchurch and Dunedin teams support businesses nationwide, with support hours and site attendance agreed for each business.
When to look closer
When directory management needs attention
Old staff accounts, unexplained administrator access, inconsistent groups and recurring sign-in problems are reasons to review the setup. Role changes can also leave access that no longer matches the job.
Accounts
Who is this account for?
Staff headcount is not the expected account count. Contractors, service accounts, integrations and emergency access can exist for good reasons.
Groups
What does this group grant?
Groups simplify access where a resource supports them, but direct grants, nested groups and application roles also need checking.
Administrators
Who can change the directory?
Administrator rights are checked against current roles, starting with the accounts that can change the directory itself.
A clean-up starts with understanding what an account does. An unused staff login and a service account that runs an integration need different treatment, so purpose and ownership are confirmed before anything is disabled. Our identity and access management guide covers the wider principles.
Systems
Active Directory, Entra ID or both
Active Directory Domain Services supports Windows domains, local resources and applications that depend on it. Microsoft Entra ID manages cloud identities and sign-ins, including Microsoft 365. They can work together, but they have different settings and responsibilities.
Microsoft describes Entra ID as a cloud identity service rather than a hosted copy of AD DS, and its comparison of the two sets out the differences. In a hybrid environment, we identify where each account or attribute is managed and confirm that a change reaches the connected directory. Synchronisation runs on a schedule, so it is not instant.
A cloud-only business may have no need for a Windows Server directory. Configuration for cloud-managed devices is handled through Microsoft Intune, a separate service from Entra ID.
Changes
Accounts, groups and access changes
We create, update and disable accounts within the agreed scope. Your business approves access; Exodesk makes the change and checks the result.
- Joiners. Accounts and group membership are set up before the start date, as part of the wider employee IT onboarding process.
- Role changes. Previous groups and permissions are reviewed as well as the new access, so access does not accumulate. Separate applications need their own changes.
- Leavers. At the agreed cutoff we disable the relevant accounts, revoke supported sessions and check separate applications and shared credentials. Business records are kept or transferred before deletion or licence removal.
- Limits. Ending access cannot retract information already downloaded, and existing app sessions or offline devices may need separate action.
Microsoft’s guidance on revoking user access explains why disabling an account is one step among several. A clear approver, an agreed cutoff and a timely request help the process work.
Policies and reviews
Policies and reviews in Active Directory management
AD DS Group Policy applies settings within its configured scope, normally to domain-joined Windows users and computers. Delivery depends on links, filtering, connectivity and processing, so we test a change and check it on the intended devices.
Sign-in controls depend on licensing. Custom Conditional Access needs Microsoft Entra ID P1 or higher, which Microsoft 365 Business Premium includes, and risk-based policies need P2. We confirm which controls your plan supports before advising on them.
Account reviews follow staff and role changes as they happen, plus an agreed schedule. Privileged, guest, service and emergency accounts are checked according to their purpose and risk.
How it works
How the arrangement is set up
Each arrangement starts with your current directories, accounts and the problems you want to solve.
Review the environment
Record directories, tenants, accounts, groups, policies, administrator rights and how requests arrive today.
Agree the scope
Confirm the systems covered, approvers, support hours, urgent leaver requests and any separately scoped infrastructure work.
Clean up
Address agreed issues such as unowned accounts or excess access, confirming purpose before disabling anything.
Manage and review
Handle routine changes as requests arrive and review access on the agreed schedule.
Domain controller health, DNS, replication, directory backup and recovery, and hybrid synchronisation can be included, but each is confirmed in the scope rather than assumed.
Cost
What affects Active Directory management cost?
Cost depends on the environment, the number of accounts and systems, the work required and the support arrangement.
- Routine administration. Account, group and access changes within the agreed hours.
- Initial clean-up. One-off remediation identified during the review.
- Infrastructure. Domain controller, synchronisation and recovery work, where scoped.
- Licences. Any additional Microsoft licences, shown separately.
- Terms. Support hours, exclusions, GST and the term, set out in the quote.
Directory administration can sit within managed IT services, a co-managed IT arrangement with your internal team, or a one-off project.
Questions
Directory management questions
What is Active Directory management?
It is the ongoing administration of accounts, groups and applicable directory policies. For AD DS, that includes Windows domain settings and Group Policy. The service scope states whether related server health, synchronisation and recovery work are also covered.
Is Microsoft Entra ID the same as Active Directory?
No. AD DS is the Windows Server directory used by domains and applications that depend on it. Entra ID is a cloud identity service. They can be connected in a hybrid environment, but neither is simply another name for the other.
Can you manage a business that only uses Entra ID?
Yes. A cloud-only business may need accounts, groups and sign-in administration without an AD DS server. We agree which tenant, applications and controls are covered.
What are security groups used for?
Groups let an administrator apply supported permissions to a set of accounts. Changing group membership can simplify access changes, but direct permissions and application-specific roles may still need checking.
Does Group Policy apply to every device?
No. AD DS Group Policy applies within its configured scope, normally to domain-joined Windows users and computers. Delivery depends on connectivity and processing. Intune device policies are a separate management approach for supported, managed devices.
What happens when a staff member leaves?
Agree when access ends and what business records must be retained. Disable the relevant accounts, revoke supported sessions and check separate applications and shared credentials. Existing sessions and offline or downloaded data can require further action.
Does every Microsoft 365 plan include the same controls?
No. Available controls depend on the plan and configuration. Custom Conditional Access requires Entra ID P1 or higher, which Business Premium includes. Risk-based policies require P2, and device management needs suitable licensing and enrolment.
When should accounts and access be reviewed?
Act on staff and role changes as they happen, and agree a review schedule suited to the business. A quarterly review can be a starting point. Check privileged, guest, service and emergency accounts according to their risk and purpose.
How much does Active Directory management cost?
The cost depends on the environment, the work required and the support arrangement. The quote identifies routine administration and separates any initial clean-up, project or infrastructure work and extra licences.
Where does Exodesk provide Active Directory management?
Our Christchurch and Dunedin teams support businesses nationwide, whether or not we manage your wider IT. Work can be ongoing, co-managed with your internal team or a one-off project, with support hours and site attendance agreed.
Next step
Discuss your directory
Tell us whether you use Active Directory, Entra ID or both, roughly how many accounts you have, and the problems or changes you need help with. Please keep passwords and account exports out of the enquiry form.
Get in touch
Talk to us about Active Directory management
Tell us about your current directories, how many people and systems are involved and the work you need covered, and we will be in touch to arrange a time that suits.
Prefer to talk?
Christchurch
Level 1, 85 Riccarton Road
Christchurch 8011
03 343 3124
Dunedin
Level 3, Bartons Building
2 Stafford Street, Dunedin 9016
03 479 2941