Using an Azure Domain Controller to Authenticate First-Logon Users on a Machine Off Network?

Question

We have a scenario where there's a computer that has been joined to our on-premise domain, but has then been placed in a location where it lacks direct connectivity to our internal network. Normally, we use a VPN to connect this machine to our network and perform tasks, but we're encountering an issue because we've enabled Azure MFA for the VPN connections. Because we're using Cisco AnyConnect, a user is unable to connect to the VPN prior to logging into Windows (Cisco's client will not authenticate with Azure MFA with their pre-login client for security reasons).

As a result, new users on this computer are unable to log in on this machine, as it lacks connectivity to our domain controllers to create their local profile during their first logon.

Is it possible to build a DC in Azure, link it to our internal AD, and allow these users to authenticate to that DC directly over the Internet, so they don't need to use a VPN for their first logon?

I don't see anything that indicates this is possible, or not, in the documentation from MS about integrating on-premise AD with Azure AD.

An important note: because of our internal AD structure, it's not feasible for us to move entirely to Azure AD DS. We are using a hybrid join setup, and while I'd love to move away from that, it would take us years of work to migrate the needed items into the cloud to just do Azure join only on our workstations.

Answer 1

Is it possible to build a DC in Azure, link it to our internal AD, and allow these users to authenticate to that DC directly over the Internet, so they don't need to use a VPN for their first logon?

You'll still need a VPN connection to this azure network. Routing windows active directory via public DNS is not possible to do.

--please don't forget to upvote and Accept as answer if the reply is helpful--