Identity & Active DirectoryWide moat

Active Directory, and its cloud successor Entra, is the quiet keystone¹ of Microsoft's enterprise lock-in, because it answers the single most fundamental question a company's computing must answer: who is this person, and what are they allowed to touch? Once an organization's entire notion of identity — every employee, every group, every permission — lives inside Microsoft's directory, that system becomes the thing every other application must consult before it does anything at all. Owning the login is very nearly owning the enterprise.

The reason this binds so tightly is that identity is not a feature bolted onto the software; it is the foundation the rest of the building sits on. The email checks the directory, the file server checks the directory, the thousand line-of-business applications a large company runs each check the directory to decide who may see what. Rip out Microsoft's identity system and you have not swapped one component — you have pulled the foundation out from under every application at once.

Microsoft has extended this from the office into the cloud with real cunning. Entra became the single sign-on that lets an employee log in once and reach everything — Microsoft's own products and a great many third-party ones besides. Every application that trusts Microsoft to vouch for the user is one more strand tying the enterprise to Microsoft, and single sign-on, sold as a convenience, is also one of the most effective lock-in mechanisms ever devised.

For a long-term owner the beauty of identity is that it is invisible and indispensable at once. Employees never think about it, executives rarely see it as a distinct line on an invoice, and yet nothing works without it. A moat the customer cannot even see is a moat the customer never thinks to attack — which is exactly why identity is the deepest and quietest thread in the whole knot.