How do I configure Azure AD connect on our Azure DC VM?

Hig Admin 1

I am trying to install Azure AD Connect on our DC hosted in Azure, however since we are not allowed to have Enterprise admin rights I am unable to get this completed. I am new to working with Azure Vms so I apologize if this questions has a very obvious answer. We inherited the Azure VM from our clients previous IT. If any other information is needed please let me know.

Andy David - MVP 141.5K Reputation points MVP

2022-12-06T19:16:45.33+00:00

The permissions needed are here:

https://learn.microsoft.com/en-us/azure/active-directory/hybrid/reference-connect-accounts-permissions

You will need those to install.
Hig Admin 1 Reputation point

2022-12-06T19:47:24.847+00:00

I understand that is what I need but how can Azure AD Connect be installed and configured if I cannot create an enterprise or even a domain admin in an Azure DC VM? From what i read in previous articles MS stated that we can never get Enterprise or even Domain Admin rights for a DC VM created in Azure cloud.
Andy David - MVP 141.5K Reputation points MVP

2022-12-06T20:07:43.183+00:00

The domain controller should be part of an existing Active Directory Forest and you would have all those rights and accounts available.
Example:
https://azurescene.com/2020/04/17/how-to-deploy-a-domain-controller-in-microsoft-azure/#:~:text=Install%20Active%20Directory%20Domain%20Services,controller%20to%20an%20existing%20domain.
Hig Admin 1 Reputation point

2022-12-07T13:15:21.117+00:00

This server we inherited was created back in 2018 in Azure Cloud. When I check the already established DC the only user that has domain admin and enterprise admin is the dcaasadmin and I am unable to give any user those rights or even add them to the built in group that has domain admin access. I see no way to give domain admin rights or enterprise rights as I am denied access since it is locked down by Microsoft. I have seen videos of people able to install Azure AD Connect on DCs created in Azure with no problem, however, these are newer videos (2021). Is there nothing that can be done? Even local users when I try to set it up it doesnt and wouldnt work because it not being a domain account.

1 answer

Andy David - MVP 141.5K Reputation points MVP

2022-12-07T13:36:49.643+00:00

Ok, what you have there is not a DC joined to your AD forest, its a DC leveraging Azure Active Directory Domain Services
It essentially a managed domain and you can not install AADConnect there.

https://learn.microsoft.com/en-us/azure/active-directory-domain-services/overview

The way it would work is you install AADConnect on a domain server, it would sync to Azure, then Azure would sync to Azure Active Directory Domain Services

https://learn.microsoft.com/en-us/azure/active-directory-domain-services/synchronization
Please sign in to rate this answer.

4 people found this answer helpful.
JamesTran-MSFT 36,361 Reputation points Microsoft Employee

2022-12-09T17:36:34.923+00:00

@Hig Admin
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

----------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.
Sign in to comment