Azure Active Directory Domain Service - Delegate Domain Join Permission

Question

Using Azure Active Directory Domain Services and I need to create a service account from a standard privileged account but it needs to be able to be delegated domain join. I can't right click and do the delegation permissions. It says I don't have permissions as an administrator of the AADDS domain. Is the only way to make this work by changing the default from 10 computers to like 10000?

Answer 1

Hi @Matthew McKenzie

Thank you for asking this question on the **Microsoft Q&A Platform. **

There are some considerations when using service accounts:

• You can't create a service account in the built-in AADDC Users or AADDC Computers OUs.
• Instead, create a custom OU in the managed domain and then create service accounts in that custom OU.

This custom group is a group managed service account (gMSA), you can create it following these steps

Hope this helps!

----------

Accept Answer and Upvote, if any of the above helped, this thread can help others in the community looking for remediation for similar issues.
NOTE: To answer you as quickly as possible, please mention me in your reply.