Can I get rid of the server if everything is already in Microsoft 365?

Often yes, but only once you know what still depends on it. Think of laptop sign-in, group policy, file shares, printers, Wi-Fi and older business software. Once those have a new home, the server can be switched off.

Do all laptops need to be set up again?

Usually, yes. A laptop joined to the local domain cannot be switched to an Entra-joined device with a single click. Windows Autopilot automates most of the re-provisioning, and files stored in OneDrive come back by themselves.

What happens to the user accounts?

While Entra Connect syncs users from the server, you manage them there. Once you turn sync off, they become regular cloud accounts managed in Microsoft 365. Only do this after every laptop has moved.

What if an application needs a local domain?

Ask the vendor about a cloud version or another way to run it. If that is not possible, a small server or hosted environment for just that application can be an interim step, while the laptops are already managed from the cloud.

Retiring the office server: how an SME moves from on-premises Active Directory to Microsoft Entra ID

At many SMEs, email, Teams and files have lived in Microsoft 365 for years. Yet there is still a server humming away in the comms cupboard. Nobody quite knows what it still does, except that people use it to sign in to their laptops. It needs patching, backing up and, sooner or later, replacing. Often it can go, but only once you have worked out what still depends on it.

Why that last server can often go

For years, an on-premises domain controller was the heart of the office network: it decided who could sign in, which settings a PC received and which shared folders someone could see. Now that email, calendars and files live in Microsoft 365, the server often does little more than handle sign-in. Meanwhile it still costs money and attention: updates, backups, power, space in the cupboard and eventually a replacement.

On top of that, older versions of Windows Server are dropping out of support. Windows Server 2012 and 2012 R2 have not received security updates since October 2023, and extended support for Windows Server 2016 ends in January 2027. If you are running one of these, you have a decision to make anyway: replace it or retire it.

What Microsoft Entra ID and Intune take over

Microsoft Entra ID is the user directory behind Microsoft 365. A Windows laptop can be joined to it directly: staff sign in with their Microsoft 365 account, optionally using Windows Hello with face recognition, a fingerprint or a PIN. Intune takes over the role of group policy: it applies settings, installs apps, handles updates and encrypts the drive with BitLocker. With device compliance and Conditional Access you can then make sure only managed, up-to-date laptops can reach company data.

Automatic Intune enrolment and Conditional Access require a Microsoft Entra ID P1 licence and an Intune licence. Both are included in Microsoft 365 Business Premium.

Start with an inventory: what still depends on the server?

The biggest risk is not the migration itself but the thing you forgot. So check these points first:

File shares. Are there still files on the server? Move them to SharePoint or OneDrive first. Read how to migrate a file server to SharePoint.
Group policy. Which settings are currently pushed from the server, such as screen lock, mapped network drives or browser settings? Decide which ones you need to rebuild in Intune and which can be dropped.
Printers and scanners. Printers shared through the server need to be offered another way, either directly or via a cloud service such as Universal Print. Scan to email is worth checking too.
Wi-Fi and VPN. Does your Wi-Fi network or VPN authenticate against the server? Then you need a different sign-in method before the server is switched off.
Business software. Older accounting, planning or industry-specific software sometimes runs with a database on the same server, or expects a domain sign-in. Ask the vendor about a cloud version or another place to run it.
Other roles. DNS, DHCP, backup software, an access control system or cameras: everything running on the server needs a new home or a deliberate end.

How the move works

Set up Intune. Prepare the settings, apps, updates and security that are now handled through group policy and manual work. Test them on one laptop.
Re-provision laptops as Entra-joined devices. A laptop joined to the local domain cannot be switched with a single click. It is usually reset and set up again, ideally with Windows Autopilot. If laptops are due for replacement anyway, combine the two; see planning laptop replacement.
Work in groups. Start with a few willing colleagues, then go team by team. Make sure files are in OneDrive before a laptop is reset.
Stop directory sync. If Entra Connect still syncs users from the server, only turn sync off once every laptop has moved. The accounts then become regular cloud accounts that you manage in Microsoft 365 from then on.
Switch the server off, but do not dispose of it yet. Leave it off for a few weeks. If nobody reports a problem, take a final backup, wipe the disks securely and decommission it.

What to watch out for

If you set things up properly, staff will no longer be local administrators on their laptops after the move, and that is the point. Read why local admin rights are better removed. Make sure MFA is on for everyone before the cloud account becomes the only key to the laptop. And do not forget backup: once the server is gone, email and files in Microsoft 365 need a backup of their own.

If one application genuinely cannot work without a local domain, that does not have to block the whole project. Sometimes a small server or a hosted environment just for that software is the best interim step, while the laptops are already managed from the cloud.

How Floor ICT handles this

Floor ICT starts with an inventory of the server: which roles, folders, printers, integrations and software still depend on it. We then draw up a plan per team, set up Intune and test the settings with a few staff members. Laptops are re-provisioned with Windows Autopilot, outside working hours or at a time that suits you. Only when everything works do we stop directory sync and switch the server off. As part of our managed service, we then look after laptops, updates and security from Microsoft 365.

View MSP packages Request an intake Microsoft 365