azure active directory domain service with PKI

testuser7 271

I have spun an "Azure-Active-directory Domain Service"

Now I am standing up "Enterprise CA" server role on one the Windows Server VM that is joined to this AAD-DS

Is the design possible ?

Can I use AAD-DS with my PKI infrastructure ?
OR

I have to spin up self-service Active Directory ?

Thanks

2 answers

Thameur-BOURBITA 32,586 Reputation points

2022-03-17T21:01:29.443+00:00

Hi,

If you want install Enterprise CA , you have to installed on server member of a active directory domain:

You can install Standalone CA , to avoid installing new domain for Enterprise CA.

Please don't forget to mark helpful reply as answer
Please sign in to rate this answer.
testuser7 271 Reputation points

2022-03-17T21:12:21.63+00:00

Thanks @Thameur-BOURBITA

I believe that is what I said.
This vm on which I am installing and configuring AD CS Certificate Authority role is joined to the AAD DS domain.

Would it work ??

Thameur-BOURBITA 32,586 Reputation points

2022-03-17T21:48:14.273+00:00

This vm on which I am installing and configuring AD CS Certificate Authority role is joined to the AAD DS domain.

Would it work ??

If you choose standard PKI yes it will work. However ,Enterprise CA option will be unavailable when you launch PKI installation.

Please don't forget to mark helpful reply as answer

testuser7 271 Reputation points

2022-03-17T22:58:40.683+00:00

What is the reason for unavailability ??

Is it because this AD is not the regular AD but AAD-DS ??

Thameur-BOURBITA 32,586 Reputation points

2022-03-17T23:15:23.533+00:00

When you install enterprise CA in AD DS , many configuration settings will be saved on active directory in Configuration partition.
The biggest difference between on-premises Active Directory and Azure AD is in the way they are structured and design, for this reason you can't install Enterprise CA in AAD , because AAD can't save the configuration settings of CA enterprise like a work-group machine.

Please don't forget to mark helpful reply as answer

testuser7 271 Reputation points

2022-03-17T23:20:44.287+00:00

Got it mostly.
Thanks @Thameur-BOURBITA

Just to confirm before closing this thread...
You are talking about AAD-DS (and not Azure-AD) right?

I believe you have practically tried after spinning up AAD-DS in one Vnet.

Thanks

Thameur-BOURBITA 32,586 Reputation points

2022-03-17T23:32:37.35+00:00

You are talking about AAD-DS (and not Azure-AD) right?

@testuser7 :Sorry , for the confusion.
To answer to your question ,I'm talking about Azure active directory and Azure AD DS . AD DS is not a domain controller on VM in Cloud.

I have a client use ADDS DS only for GPO, below some difference between AADS DS and AD DS:

917392
Please don't forget to mark helpful reply as answer

testuser7 271 Reputation points

2022-03-18T12:02:24.033+00:00

Thanks @Thameur-BOURBITA for the chart. It helps.

I am sorry but still there is a slight confusion in my mind.
AAD is NOT in the picture at all.

We just wanted to make sure if this managed-service called AAD-DS capable to support Enterprise PKI infrastructure.
Can it push the auto-enrollment of enterprise-certs to its domain-joined VMs etc. ??

Thameur-BOURBITA 32,586 Reputation points

2022-03-18T12:54:13.677+00:00

Hi

Can it push the auto-enrollment of enterprise-certs to its domain-joined VMs etc. ??

I didn't test it but I think yes , because AADS-DS support GPO like AD DS and auto-enrollment is configured through group policy.

I am sorry but still there is a slight confusion in my mind.
We just wanted to make sure if this managed-service called AAD-DS capable to support Enterprise PKI infrastructure.

If you still not sure , I recommend you to contact Microsoft directly , to give a confirmation and answer for all questions about Cloud and supported configuration.

Please don't forget to mark to mark helpful reply as answer

VEIRMAN Loïc 1 Reputation point

2022-07-24T20:00:34.673+00:00

AAD : Azure AD
ADDS : Active Directory Directory Services

ADD-DS simply does not exist (it refers to AAD). AAD is not ADDS, AAD is flat whereas ADDS uses tree structures and partitions.
Sign in to comment
Tobi Kr 26 Reputation points

2023-01-22T20:45:24.5366667+00:00

@VEIRMAN Loic AAD-DS does exist (Azure AD Directory Services) and it does not support Enterprise CA due to the limited permissions you will get as AAD-DS Admin
Please sign in to rate this answer.
cosy M 6 Reputation points

2023-08-29T01:55:50.0833333+00:00

Have you sort this?
Sign in to comment