Can you please confirm that in order to get our Active Directory users (and profiles/roles) synchronized with Salesforce, we need to get Salesforce Identity licences?
You are referring to the Identity Connect product:
Identity Connect integrates Microsoft Active Directory (AD) with Salesforce. User information entered in AD is shared with Salesforce seamlessly and instantaneously. Companies that use AD for user management can use Identity Connect to manage Salesforce accounts.
Changes in AD are reflected in Salesforce in near real time. For example, when a user is created in AD, the Salesforce user account is created as part of the provisioning process. When deprovisioned, the user’s Salesforce session is revoked immediately.
You can also use Identity Connect for single sign-on to Salesforce
Identity Connect is an add-on license available for Salesforce users on most Salesforce products. Add-on means that you have to purchase a user license (which can be an External or Internal Identity) and then buy Identity Connect on top of that. There might be product bundles that are referred to as "Identity" and these bundles might include both user licenses and Identity Connect. Talk to your account executive, these are questions they can answer.