Hands up if you like deploying Active Directory Domain Services. Hands up if you enjoy managing domain controllers and flexible single master operation (FSMO) roles and site replication. Hands up if you believe this work directly positively impacts your business's revenue. Hands up if you'd love for there to be a managed service that gives you Active Directory without the pains of managing it.
Latest posts by David O´Brien (see all)

If you put your hands up at the last question, there's great news—Azure has something for you: Azure Active Directory Domain Services (AADDS), not to be mistaken for Azure Active Directory (AAD).

AADDS is an almost-feature-complete Active Directory with a few limitations, mainly:

  • no domain admin privileges
  • unable to extend AAD schema
  • single virtual network (VNet) and single region only
  • no failover to other regions for disaster recovery (DR)
  • unable to join VM-based domain controllers to domains
  • no direct access to domain controllers
  • only one AADDS per Azure tenant

The most critical limitation in my opinion is the fact that AADDS is single-region only, and you can only have one per tenant, so unless your workloads' functionality doesn't rely on Active Directory, or you do not require a test AADDS instance, you're good.

For the latter, you can obviously create a new AAD tenant and test with that. For the former, well, don't rely on Active Directory. (I know, legacy…) Microsoft has documented a few more points to consider whether AADDS is right for you here.

Assuming all the above sounds okay to you, and you should seriously consider this service because a lot of the AAD-managing overhead just disappears, then how you do deploy AADDS?

Prerequisites for Azure Active Directory Domain Services ^

First, check that you are deploying the service into a supported region. In any of the supported regions, we will need to deploy a VNet because AADDS needs a dedicated subnet.

In your Azure PowerShell, follow these steps to put the prerequisites in place. This assumes you are deploying AADDS into a new resource group and a new VNet in the australiaeast region. Make sure that if this doesn't fit your use case, you change these values.

New-AzResourceGroup -Name aadds -Location australiaeast
New-AzVirtualNetwork -Name aadds -AddressPrefix  ResourceGroupName aadds -Location australiaeast
$vnetConfig = Get-AzVirtualNetwork -Name aadds -ResourceGroupName aadds
$subnetConfig = Add-AzVirtualNetworkSubnetConfig -Name aadds  AddressPrefix -VirtualNetwork $vnetConfig
$vnetConfig | Set-AzVirtualNetwork

With this created, we can now deploy AADDS.

Create a new AADDS deployment ^

The next steps we will complete in the Azure console because there is no Azure PowerShell support for deploying or configuring AADDS. There is Azure Resource Manager (ARM) template support, but we will keep it light for this article and stick to the portal.

Browse to your resource group and click the add button.

Search for AADDS in the marketplace

Search for AADDS in the marketplace

Search for directory services, click the tile here, and select create. In the next step, you will configure the basic settings for this domain.

Create the AADDS basics

Create the AADDS basics

Make sure you configure the right DNS name for your domain. In the next step, you will select the VNet and subnet or network you already created previously.

Create the AADDS network

Create the AADDS network

For the next two steps, you will just accept the defaults for this tutorial. The wizard will create a new AAD group called AAD DC Administrators, and to manage the domain going forward, you will need to be a member of this group.

You can configure this now or also later on. Leave the synchronization scope at All for now. However, you will not be able to change this setting once you deploy the domain. If you want to change the scope to only certain groups and users, you will have to delete the domain and redeploy it.

Create the AADDS summary

Create the AADDS summary

Check the summary screen, and if it all looks alright, hit OK. The deployment can take up to 60 minutes. So go and have a tea or 12.

Subscribe to 4sysops newsletter!

Manage AADDS ^

To start managing your new AADDS domain now, head over to the official documentation. In my next post, I will show you how you can join an Azure VM to AADDS.

  1. Yves 10 months ago

    Any suggestions to simulate a failover of the managed domain using replica sets?. Currently replica sets are still in preview but there seems to no documentation to advise of failover testing of a managed domain


Leave a reply

Please enclose code in pre tags

Your email address will not be published. Required fields are marked *


© 4sysops 2006 - 2021


Please ask IT administration questions in the forums. Any other messages are welcome.


Log in with your credentials


Forgot your details?

Create Account