Azure AD DS and Azure AD

Question

Hi!

I have the following issue:

I have created a domain and a VM in Azure and I managed to domain join the VM to my domain. Now, when using Azure AD connect I am prompted to insert an Enterprise Admin Account which is not possible to be found anywhere. Additionally, a domain admin account would suffice, but I have no permissions to add myself to the domain admin.

Question is: How can I gain those privileges? Checked everywhere but there is no straight answer. I have seen the need to be in an Enterprise Agreement with Microsoft to be able to have an Enterprise Admin Account which seems a bit redundant.

Thank you!

Answer 1

Hi! To be sure I understand it correctly (because the subject says Azure ADDS) that you likely provisioned Azure AD Domain Service and then joined a VM to this domain, if yes then AAD connect is not suitable for this architecture. AADDS is a managed domain service for supporting legacy application for customer's benefit when they do lift & shift, and all high privileged accounts (EA, DA, etc) are locked out with Microsoft.

https://learn.microsoft.com/en-us/azure/active-directory-domain-services/synchronization

Thanks!

Answer 2

Hi Florian, these are the built-in security groups in Active Directory and are required for the administrator account that you are using to configure Azure AD Connect. If you managed to perform a domain join then you likely are a member of the required security roles already or else you can add yourself to them.

https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups#default-active-directory-security-groups