Azure AD Directory Services - Custom Domain

Question

We currently have hybrid on-prem / Azure AD setup, but require LDAP access to the Azure Directory meaning we have to setup Azure AD Domain Services. The online documentation states I should setup a custom domain name - in the example of contoso.com, the recommendation is to setup aaddscontoso.com. That will enable us to create DNS entries and CA certified certificates.

How will LDAP queries work with the custom domain? Surely all LDAP responses for users in Azure AD, will be set to user@aaddscontoso.com and not user@Company portal .com - the latter is what we require.

Thanks,

Al

Answer 1

Hello @AllanBrowne-9995 ,

You can use contoso.com as internal Domain name of the AAD domain services instance (also called managed domain name) as well. You just need to use a custom domain name which is routable over the internet and you have ownership of the same so that you can get a certificate from public CA and create a ldap.{domain}.{com} record in the public DNS for the same. Please use the details provided in advanced setup for managed domain.

As you mentioned that you have hybrid onprem/azure environment , you already have Azure AD connect for syncing the users from on-prem to Azure and once you enable AAD domain services managed domain then you will need to force sync the password hash again so that NTML/Kerberos hashes get generated and synced to Azure AD and then within the Azure AD domain services managed domain . This is a required step if you would like your users to be able to use same password to access the secure LDAP . If you are using a AD connect hybrid setup without Password hash sync you may have to enable it . If the version of your Azure AD connect is lower than 1.1.614.0 then you would need to update it and enable Password Hash sync in order to have this working so that NTLM/Kereros hash for on-prem user's passwords are generated and synced to the cloud. Please follow the article for Password hash sync in AAD domain Services managed domain to understand the same in detail.

A DNS entry with Ldap.domain.com (if managed domain name is domain.com) needs to be created as explained in the article for configuring Secure LDAP . also all the clients whoever will access the managed domain using LDP or any other LDAP compliant tool would need to have the certificate installed on their local machines.

I hope this explanation clarifies your queries, should you have any other query feel free to let us know and we will be happy to help . I have included some links in the answer and I assume you have already seen some of them . Please check them for deeper understanding and if there are any residual questions , feel free to ask. If the information provided in the post is helpful , please do accept the post as answer so that it will help other members of the community .

Thank you.