In abstract, centralise everything. You have a "Domain Controller" which is basically a server which everything authenticates against.

Settings from domain controllers (privileges etc) are propagated over the network to other servers (Email,File servers etc).

So when you authenticate against a DC (by logging into your workstation etc) you get a token back which can be sent to other hosts on the network who then understand what to grant access to based on that token.

This makes it easier for a large org with an international presence to allow say marketing teams in the London and New York offices to have access to the same files etc and be able to use each others workstations interchangeably whilst all being managed by the IT team in Mumbai.

This means that if you stick to mainly MS products you get the advantage of knowing that everything will integrate into AD so you spend less time handrolling shared authentication etc.

Nitpick - AD supports a centralised topology, but is more effective when decentralised. You can deploy as many domain controllers as you like, you can separate global catalogues entirely, and deploy multiples of those, and you can even separate domains within forests, and then create cross-domain trusts. If you want to create cross-forest trusts you can do that using Active Directory Federation Services (ADFS).

ADFS is hugely under-rated, and is arguably the most capable identity federation software out there because it's the only implementation I know of that does both passive- (browser-based), and active federation, which allows you to authenticate against AD from your JSON service.

That story gets even better with U-Prove (http://www.microsoft.com/mscorp/twc/endtoendtrust/vision/upr...).

Single sign on, group policies, user account control on a global scale.