In a Hybrid-IT scenario, Active Directory from on-premises can be extended to serve as the

authentication mechanism through an Azure deployed domain controller (as well as potentially using the integrated DNS).

It is important to distinguish between traditional Active Directory Servers and Microsoft Azure Active Directory that provides only a subset of the traditional on-premises AD offering. This subset include Identity and Access Management, but does not have the full AD schema or services that many 3rd party application take advantage of. While Azure Active Directory IS a requirement to establish authentication for the Azure virtual machines in use, and it can synchronize users with customers’ on-premises AD, the two are explicitly different and customers will likely continue to require full Active Directory servers deployed in Microsoft Azure.