Let's start by telling you what Azure AD isn't. It is not the managed version of the Windows Server AD. Despite its resemblance of the name, Azure AD is just an IAM service, managed and hosted by Microsoft in Azure. We should not even try to make a comparison between the two, because they have different scopes and features. It is true that we can link Azure AD with an on-premise AD, but only for the purpose of extending the on-premise AD functionalities to work with Internet-based applications. Throughout this chapter, we look into Azure AD as a stand-alone service without any kind of integration with on-premise environments.

To focus on what the role of Azure AD exactly is, look at this image:

As you can see, different applications can use Azure AD as their IAM solution, to provide authentication/authorization for web applications and services. Since Office 365 or Azure itself uses it to authenticate users, a Custom Application can do the same too.

We should assume that...