AWS Directory Service

Managed Microsoft Active Directory options in AWS — run a real AD in the cloud, or proxy to the one you already have.

Verified against AWS documentation · 2026-08-28

Key facts

01Three flavors: AWS Managed Microsoft AD (real Windows AD in AWS), AD Connector (proxy to on-prem AD, caches nothing), Simple AD (cheap Samba-based AD-compatible)
02Managed Microsoft AD: actual Windows Server AD, two DCs across two AZs, supports trusts, MFA, schema extensions, seamless EC2 domain join, RDS for SQL Server
03Managed Microsoft AD editions: Standard (~30,000 objects) vs Enterprise (~500,000 objects + multi-Region replication)
04AD Connector: identities stay on-prem, needs VPN or Direct Connect back to your AD — no trusts, no standalone directory
05Simple AD: ≤5,000 users, no trusts, no MFA — and AWS closed it to new customers, though exams still treat it as a live option

Phrases and scenarios that point here.

"Existing on-premises AD" + "don't want directory data in the cloud" → AD Connector
"AD-aware workloads on AWS" (SharePoint, SQL Server, .NET) or "trust relationship with on-prem AD" → AWS Managed Microsoft AD
"Lowest cost", "basic AD features", "under 5,000 users", no trust/MFA needs → Simple AD
MFA with corporate credentials for WorkSpaces/AWS apps → Managed Microsoft AD or AD Connector (RADIUS), never Simple AD

Single sign-on into AWS accounts and SaaS apps → IAM Identity Center (it can *use* Directory Service as its identity source, but it's the SSO layer, not the directory)
Sign-up/sign-in for your own web or mobile app's customers → Amazon Cognito
Fine-grained permissions to AWS APIs and resources → IAM

01Lifting SharePoint or a legacy .NET intranet into AWS without rebuilding auth — Managed Microsoft AD gives it the same domain it had in the server room
02A company rolling out WorkSpaces for 2,000 staff who already log in via corporate AD — AD Connector lets them keep one password and zero cloud-side directory
03Joining fleets of EC2 Windows instances to a domain so group policies apply the moment they boot, instead of hand-configuring each box
04Two-way trust between on-prem AD and Managed Microsoft AD, so cloud resources authenticate corporate users without migrating or syncing a single account
05Enabling Windows Authentication on RDS for SQL Server — one of the exam's favorite Managed-Microsoft-AD-only tricks

01Hourly per directory, priced by type and size — Managed Microsoft AD by edition (Standard/Enterprise), AD Connector and Simple AD by size (small/large)
02The hourly rate includes two domain controllers; adding DCs for scale or extra AZs adds roughly proportional hourly cost each
03Directory sharing: hourly charge per *additional AWS account* you share with — sharing into more VPCs in the same account is free
04AD Connector costs nothing when used with WorkSpaces, WorkDocs, or WorkMail (minimum active-user thresholds apply)
05Enterprise multi-Region replication bills data transfer out of the domain controllers separately