Active Roles 7.1 and Azure

Question

Hello community, 
 I upgraded the installation of AR, and connected it to the customer's Azure. The question is: Is it possible to manage cloud only users, o to use Active Roles I MUST create also an on-permise user? 
 Thanks a lot, 
 
 G.O.

Aidar.Karabalaev · Answer

Correct. My understanding: I do not see, if AAD\operator accesses AR, how AR can authenticate him against AAD. 
AR is a “virtual permissions layer”: Identity – Access Mask – Resource. Login user must authenticate to AR (= AD\operator accesses AR resource asking AD Authentication Mater (token) to manage AD\object with AR Workflow format– standard Windows OS story) 
If someone creates AAD\user then AR Sync will create twin AD\user to be managed as AD\user by AR workflow.