question

StephenStark-0845 avatar image
StephenStark-0845 asked ·

Azure Active Directory Domain Service Setup Best Practices

We have an instance of Azure Active Directory services that was created when we setup our Office365 instance using a domain we assigned (for example contoso.com). We would like to add Active Directory Domain Services to this instance so that we can join servers created in Azure to the domain. Is it best practice to create the Domain Services instance under a subdomain (for example aadds.contoso.com), or better to just create it under the root domain (contoso.com)?

Thanks in advance for any advice.

azure-ad-domain-services
10 |1000 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

thgibard avatar image
thgibard answered ·

OK perfect.

Azure Active Directory Domain Services is just a standard Active Directory forest where you don't need to manage the servers. But you will have nearly the same possibilities as a standard Active Directory domain that you would have deployed locally inside your datacenter.

However, Azure Active Directory and On-Prem ADDS are really different components. You will not for example be able to setup a trust between your Azure Active Directory and your AADDS. So, there is nothing logical to name your AADDS with a specific domain name that would be a sub domain. However, you should ask yourself the question about using AADDS OR deploying IAAS VM and deploy manually your Active Directory domain. Why you're needed an on-prem domain ? Maybe for some application that cannot be integrated directly through Azure Active Directory ? Is there any specific reason (just to be sure to understand your constraints).

Anyway in both scenarios AADDS or manually deployd ADDS, you can chose a complet different domain. But if you need after to get your accounts populated in your Azure Active Directory - you will require standard Hybridation process with AAD Connect. So if the UPN extension does not correspond to the name you've choosen for Azure Active Directory and O365, you will need to modify the UPN Suffix. Something that a lof of companies are doing when going to O365.

8003-002-add-a-new-upn-suffix.png



Share
10 |1000 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

thgibard avatar image
thgibard answered ·

Hello,

I'm not sure I understand perfectly your use case. Let's double-check please.
You've created an O365 Tenant with an Azure Active Directory. You've processed the association of a personal domain to this Azure Active Directory. For what I'm understanding, that's mean all your people and the accounts created are provisioned directly in Azure Active Directory - so it's not an Hybrid scenario with AAD Connect. Correct ?

Now, you're speaking about an ADDS instance ? That's mean AD deployed on-prem and you want to populate the accounts from this AD on-prem to your same Azure Active Directory ? Also, I need to be sure you're speaking about ADDS deployed with on-prem Domain Controllers and not "Azure Active Directory Domain Services" which is again something else.

Thanks in advance

Share
10 |1000 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

StephenStark-0845 avatar image
StephenStark-0845 answered ·

Thanks for the reply.

Yes, you correct in your first assumption - this is not a Hyrbid scenario - Azure-based Active Directory only.

As for the second question, I accidentally left something out of my original description/question. I meant to say Azure Active Directory Domain Service (AADDS) - meaning, we are adding an instance of AADDS to our Azure Active Directory instance.

My apologies for any confusion.

Share
10 |1000 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

StephenStark-0845 avatar image
StephenStark-0845 answered ·

Thanks for the feedback!

Share
10 |1000 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

ohseongkooi-0326 avatar image
ohseongkooi-0326 answered ·

Blockquote

Share
10 |1000 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

ohseongkooi-0326 avatar image
ohseongkooi-0326 answered ·

strong text

Share
10 |1000 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.