AVD with .local Domain and AD Connect?

Vanessa P 1 Reputation point

Hi Everyone, I have a client that wants to migrate from on prem to hybrid to eventually cloud only and they have a few apps that I want to run via Azure Virtual Desktop as opposed to RDS (licensing for avd is bundled into their M365 licensing) but I'm having an issue with the authentication because of how their domain is setup. They currently have a .local domain on prem that self routes to the domain controller as the DNS server, and they have a .com that is associated and validated with M365. It was my understanding that So long as you have Azure AD Connect you can join a AD DS domain to a vm for avd and then have that authenticate using Azure AD Credentials. But because their domain is not routable I'm stuck. If I put the vm's involved on the .com domain then they can't access resources (at least I don't think they can) from the .local and I'm not sure how to to make the .local domain routable in a way that M365/Azure AD will accept so that everything talks to each other.

I currently have a DC on prem that is .local, that same DC extended into a VM in azure, my app server in azure and then the avd vm. With a Ipsec tunnel between the vnet and the company network.


Thank you in advance!

Azure Virtual Desktop
Azure Virtual Desktop
A Microsoft desktop and app virtualization service that runs on Azure. Previously known as Windows Virtual Desktop.
1,249 questions
Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
5,173 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
17,605 questions
{count} votes

2 answers

Sort by: Most helpful
  1. Justin Verstijnen 196 Reputation points

    We are using Azure Virtual Desktop in the exact same setup. We have 2 domain controllers on-premises with an company.local domain. In the cloud (Azure AD) we have a company.com domain. With AD Connect we sync all users from company.local to company.com. Also, it is possible in your on-premises AD to create a UPN suffix. Here you can configure the users to also use the company.com domain in your on-premises AD.

    For more redundancy we also have 2 domain controllers in Azure to handle sign-in requests done by Azure Virtual Desktop.

    When you have this configured your users will be able to use AVD with their synced Microsoft 365 account.

  2. Limitless Technology 43,316 Reputation points


    Thank you for posting your query.

    Kindly follow the steps provided below to resolve your issue.

    Azure AD Connect only synchronizes users to domains that are verified by Office 365. If your internal AD DS only uses a non-routable domain, this can't possibly match the verified domain you have on Office 365. You can fix this issue by either changing your primary domain in your on premises AD DS, or by adding one or more UPN suffixes.

    Here is the nice article explains, how to add UPN suffixes and to move forward with the directory synchronization.

    Go to this link for your reference https://learn.microsoft.com/en-us/answers/questions/27357/configuring-azure-ad-connect-with-a-local-domain-u.html


    If the answer is helpful kindly click "Accept as Answer" and upvote it. Thanks.

    0 comments No comments