How do I connect an on prem Windows Server VM running in vCenter to my managed domain service running in azure

Question

Hello, I am trying to test the managed domain services to solve a current need. We currently have an on-prem data center where we have vCenter. We decided we wanted to be able to use SSO using our Azure identities and stop using local accounts. I want to be able to use the managed domain to create an ADFS on-prem and have my cloud identities synced over to on-prem and be able to then connect vcenter and use SSO with those identities. In the articles and guides, Microsoft recommends another subnet in the vnet and launching a Windows server to join the domain. What if I want to use the existing Windows server VM in my on-prem vCenter to join the domain? How would I accomplish this? I do not want to launch and pay for a Windows server when I already have an on-prem environment with resources to deploy VMs. Additional questions I have: How does one connect and manage the domain controllers after creating the managed domain service? Does the first Windows server to connect to the domain become a DC?

Answer 1

first, you need to set up a network connection between your on-prem environment and Azure, configure domain services in Azure, and then join your on-premises VM to the Azure domain.

to complete this steps you need to follow this documents

https://learn.microsoft.com/en-us/entra/identity/domain-services/join-windows-vm

https://learn.microsoft.com/en-us/windows-server/manage/windows-admin-center/azure/

https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-authentication/GUID-3818FE5A-3530-4215-9439-7C6813C94252.html

Answer 2

Hi Peniel Bikila,

If you want to use the existing Windows server VM in my on-prem vCenter and join to a domain you can follow below recommendations:

• First verify that you VM can reach the managed domain on the virtual network. If you don't receive a prompt that asks for credentials to join the domain, there's a connectivity problem.
• Verify the VM is connected to the same virtual network that Domain Services is enabled in, or has a peered network connection. Try to ping the DNS domain name of the managed domain, such as ping aaddscontoso.com. If the ping request fails, try to ping the IP addresses for the managed domain, such as ping 10.0.0.4. The IP address for your environment is displayed on the Properties page when you select the managed domain from your list of Azure resources.
• Id you can ping the IP address but not the domain, DNS may be incorrectly configured. Confirm that the IP addresses of the managed domain are configured as DNS servers for the virtual network. Try to flush the DNS resolver cache on the virtual machine using the ipconfig /flushdns command.
• If you receive a prompt that asks for credentials to join the domain, but then an error after you enter those credentials, the VM is able to connect to the managed domain. The credentials you provided don't then let the VM join the managed domain.
• Make sure that the user account you specify belongs to the managed domain. Confirm that the account is part of the managed domain or Microsoft Entra tenant. Accounts from external directories associated with your Microsoft Entra tenant can't correctly authenticate during the domain-join process.

After that you connect and manage the domain controllers after creating the managed domain service, you can use the same Remote Server Administration Tools (RSAT) as with an on-premises Active Directory Domain Services domain. As Domain Services is a managed service, there are some administrative tasks that you can't perform, such as using remote desktop protocol (RDP) to connect to the domain controllers.

Regarding your additional questions:

• Managing Domain Controllers: After creating the managed domain service, you can manage the domain controllers using tools like Windows Admin Center. You can also use traditional domain management tools as the Azure managed domain service is fully compatible with Windows Server Active Directory
• Domain Controller Assignment: The first Windows Server that connects to the domain does not automatically become a Domain Controller. Domain Controllers in Azure are managed by Microsoft and you consume these domain services without deploying, managing, and patching domain controllers yourself

---

References and additional help:

• Tutorial: Join a Windows Server virtual machine to a Microsoft Entra Domain Services managed domain
• Tutorial: Create a management VM to configure and administer a Microsoft Entra Domain Services managed domain
• Tutorial: Join a Windows Server virtual machine to a Microsoft Entra Domain Services managed domain

Let me know if you have additional doubts, Luis

---

If the information helped address your question, please Accept the answer.