Hi Marty,
Azure AD PTA is an alternative to using AD FS. It's based on a design premise that the cloud identity becomes the dominant identity rather than the corporate one with AD FS and you authenticate against Azure AD primarily and then against your corporate one,
animated courtesy of Kerberos delegation. Whether you should or should not opt to embrace this solution is not a simple answer. For example, you've highlighted that you use AD FS 2.0, meaning that you've not updated your AD FS configuration for a number of
years. Depending on a given point-of-view, one might take that as being:
(a) your organization likes to make big jumps infrequently every few years and are technically aggressive when those jumps happen; ergo PTA might be a good solution
(b) Conversely, the fact that you are using AD FS is 2.0 / 2008 R2 might suggest that the company is traditional, not technically aggressive and this cloud thing, Office 365 notwithstanding, is all a bit new
(c) somewhere in-between or some other reason that my lack of imagination couldn't come up with :)
Should you wish to move towards the Identity-as-a-Service concept that Microsoft offer, understand that there are numerous benefits that this brings to the plate and, of course, some limitations. It's incumbent on you to work out what those things
are and consider are whether you or your organization/security team are ready to move in that direction.
http://blog.auth360.net
