AWS’s Security Blog says the service now underpins deployments of Amazon RDS for SQL Server, Amazon FSx for Windows File Server, Amazon WorkSpaces, and other directory-aware AWS services for “thousands” of enterprises. That scale claim is AWS’s own and is not accompanied by a customer count, a workload total, or a public breakdown by edition. What the company has documented clearly is the product’s evolution: its managed AD offering has moved from a Windows Server 2012 R2-based, two-Availability-Zone service into a Windows Server 2019-based platform with resource-forest, multi-Region, API-management, and hybrid-domain options.
For Windows administrators, the important takeaway is practical: AWS Managed Microsoft AD is no longer simply a shortcut for standing up a separate cloud domain for WorkSpaces or EC2. It is now a decision about whether AWS should run a separate AD forest for AWS resources or operate domain controllers that become part of an existing AD domain.
Managed domain controllers still mean managed boundaries
AWS’s core proposition has remained consistent since 2015. The service deploys at least two domain controllers across separate Availability Zones, then AWS handles host monitoring, recovery, replication, snapshots, and software updates. Customers retain responsibility for directory content: users, groups, organizational units, Group Policy design, trusts, delegated rights, application configuration, DNS planning, and access governance.
That distinction is easy to miss in a product anniversary narrative. AWS Managed Microsoft AD removes the need to patch and replace domain controllers, but it does not remove the need to operate Active Directory. A poorly designed trust, an overprivileged delegated group, broken DNS forwarding, or a Group Policy conflict remains the customer’s problem even when AWS owns the underlying Windows Server instances.
The same boundary applies to privileged administration. In Standard and Enterprise editions, AWS documentation says AWS has exclusive control over the built-in Domain Administrator and Enterprise Administrator privileged users and groups so it can operate the directory service. The customer-created
Adminaccount has substantial delegated capabilities, including user, group, OU, DNS, Group Policy, gMSA, and Kerberos constrained-delegation administration, but it is not an unrestricted Domain Admin account.
That is the tradeoff administrators are buying. The service reduces the operational burden of domain controller infrastructure precisely because AWS retains control over the pieces that can destabilize it. Organizations with applications that expect unfettered control of domain controllers, custom agents, or invasive security tooling should treat that limitation as an architecture requirement, not a footnote.
Hybrid Edition changes the architecture, not the service boundary
AWS introduced AWS Managed Microsoft AD Hybrid Edition on August 1, 2025, not in 2026, despite the anniversary post describing it as having launched “earlier this year.” AWS’s August 2025 announcement and its current documentation describe Hybrid Edition as a way to extend an existing self-managed AD domain into AWS by adding AWS-operated domain controllers to that domain.
This is materially different from Standard and Enterprise editions. Those editions create a new managed AD domain and are commonly used as a resource forest: the existing on-premises or multi-cloud forest remains the identity authority, while a trust gives users access to AWS-based resources. Hybrid Edition instead places AWS-managed domain controllers in the customer’s existing AD domain and relies on normal AD replication.
For organizations carrying years of Group Policy, service accounts, security principals, ACLs, schema extensions, and application dependencies, that can eliminate the design and operational friction of a separate forest and trust relationship. An FSx file server or RDS for SQL Server deployment can use the same domain identity structure rather than an AWS-specific forest with cross-forest access rules.
But Hybrid Edition is not a one-click conversion of every existing AD deployment. AWS’s own implementation guidance requires a single-forest, single-domain Active Directory environment with at least two existing domain controllers. Those controllers must be registered with AWS Systems Manager, pass a Directory Service assessment, and be reachable from the AWS VPC. AWS also requires credentials for an administrator in the self-managed domain during provisioning.
The administrative-control claim also needs careful reading. Hybrid Edition preserves the customer’s existing domain and the administrative rights already held in it. However, AWS still creates a reserved OU, AWS-managed accounts, delegated groups, and Group Policy Objects for the AWS-operated domain controllers. AWS documentation says customers cannot delete, modify, or unlink those managed GPOs, and it does not permit monitoring agents on Hybrid Edition domain controllers.
In other words, Hybrid Edition gives an AD team continuity over its domain, identities, policies, and existing administration model; it does not turn AWS’s domain controllers into ordinary customer-operated DCs. That is a reasonable design boundary, but it makes a predeployment review essential for teams that depend on endpoint agents, custom DC hardening baselines, or direct modification of domain-controller policy.
Standard, Enterprise, and Hybrid now answer different questions
AWS’s edition model is more coherent than the anniversary post’s long feature chronology suggests. Standard and Enterprise are sizing and topology choices for a new managed AD domain. Hybrid is an architectural choice for organizations extending an existing one.
Standard Edition supports approximately 30,000 directory objects using 1 GB of object storage. AWS positions it for small and midsize organizations, test environments, or resource-forest deployments in one Region. The “approximately” matters: AWS says the practical limit varies with object size and application behavior, so a directory nearing that number needs capacity planning rather than a blind headcount calculation.
Enterprise Edition raises the advertised capacity to approximately 500,000 objects and 17 GB of object storage. It also supports multi-Region deployment and much wider account sharing. Current AWS quotas allow a Standard directory to be shared with up to 25 AWS accounts, Enterprise with up to 500, and Hybrid with up to 125. Enterprise’s multi-Region limit is five total Regions: one primary Region and up to four additional Regions.
Those numbers make Enterprise the option for an AWS resource forest that must serve many accounts, regions, or large workloads. They do not make it interchangeable with Hybrid. An Enterprise directory can trust an existing AD domain and allow existing users to access AWS resources without moving identities into AWS. Hybrid instead adds AWS-managed DCs to the actual existing domain, carrying a different replication, governance, and recovery profile.
AWS has also removed one long-standing operational annoyance for Standard customers. Since October 2, 2025, the
UpdateDirectorySetupAPI has allowed Standard-to-Enterprise upgrades without opening an AWS Support case. AWS says the process creates an automated pre-upgrade snapshot and upgrades domain controllers sequentially to preserve availability. That is useful for infrastructure-as-code and operational automation, although it should not be read as proof that every application will be unaffected. AD-dependent applications should still be tested against maintenance and topology changes.
The more consequential change is API access to directory objects
The 2024 addition of user and group CRUD operations through the AWS Management Console, CLI, and Directory Service Data APIs is arguably more useful day to day than the anniversary framing. Before that feature, many teams had to expose traditional AD administration paths through a bastion host, VPN, or management network simply to create users or change group membership.
AWS says the APIs can support automation from external identity sources and HR systems, and can also be used to remove compromised accounts or group memberships after a security event. For teams operating a dedicated AWS resource forest, that makes it feasible to automate a tightly bounded identity lifecycle without placing a general-purpose Windows management host in the directory network.
It is still bounded object management, not a promise that all Active Directory administration is now API-first. Group Policy design, trusts, DNS architecture, delegated permissions, schema decisions, and the many application-specific reasons an enterprise depends on AD remain conventional Windows administration work. The APIs reduce a particular access problem; they do not turn a managed directory into a complete identity-governance platform.
AWS’s anniversary post also says more than 20 AWS services now integrate natively with Managed Microsoft AD. The useful operational point is narrower: AD remains a requirement for several major Windows-heavy AWS designs, particularly Windows-authenticated database access, SMB file services with Windows ACLs, domain-joined virtual desktops, and legacy applications that rely on LDAP, Kerberos, NTLM, or Group Policy. Those dependencies are why a managed AD service has persisted while cloud identity strategies increasingly center on federated and SaaS-first authentication.
AWS has not announced a specific next feature, date, pricing change, or expansion plan in the anniversary post. The immediate decision for IT teams is therefore unchanged: use Standard or Enterprise when an isolated AWS resource forest and a trust model fit the security design; use Hybrid Edition only after validating that the existing domain, replication model, agent requirements, and administrative controls can live with AWS-operated domain controllers.
References
- Primary source: Amazon Web Services (AWS)
Published: August 7, 2026 at 7:37 PM UTC
A decade of enterprise identity in the cloud with AWS Managed Microsoft AD | AWS Security Blog
Ten years ago, we launched AWS Directory Service for Microsoft Active Directory, a fully managed Microsoft Active Directory in the AWS Cloud. In that original announcement, Jeff Barr described a straightforward promise: “You will spend less time administering and more time working on your...aws.amazon.com - Related coverage: aws.amazon.com
Extend your Active Directory domain to AWS with AWS Managed Microsoft AD (Hybrid Edition) | Microsoft Workloads on AWS
Introduction Today, we are announcing the general availability of the Hybrid Edition of AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD). This new edition lets you extend your existing self-managed Active Directory (AD) domain to AWS Managed Microsoft AD while...aws.amazon.com - Related coverage: docs.aws.amazon.com
AWS Managed Microsoft AD - AWS Prescriptive Guidance
Guidance about reducing the costs of using AWS Managed Microsoft AD.docs.aws.amazon.com
- Related coverage: docs.aws.amazon.com
AWS Managed Microsoft AD - AWS Directory Service
Use Directory Service to run Microsoft Active Directory as a managed service, with host monitoring and recovery, data replication, snapshots, and software updates that are automatically configured and managed for you. - Related coverage: aws-news.com
AWS Managed Microsoft AD is now available on Windows functional level 2016 | The AWS News Feed
AWS Managed Microsoft AD now runs on Windows functional level 2016, automatically upgraded for all existing directories, providing enhanced security…aws-news.com - Related coverage: download.microsoft.com
- Related coverage: assets.applytosupply.digitalmarketplace.service.gov.uk
Microsoft Word - AWS G-Cloud 14 Service Definitions - Cloud Services_Partner Content v1
PDF documentassets.applytosupply.digitalmarketplace.service.gov.uk
