Removing Azure AD Domain Services

Question

Removing Azure AD Domain Services

PCCFIAU 26

I installed Azure AD Domain Services as I wanted to better control access to certain Azure resources (Database), however the use case for that has fallen away. Consequently I'd like to uninstall Azure AD Domain Services (so as to eliminate the unwanted cost), but I'm concerned about possible repercussions. The business used Microsoft 365 and all logins etc. were previously managed through there (and I assume still are as no other configuration changes were made). I was working on the assumption that Azure AD Domain Services simply syncs with what is manages through the Microsoft 365 portal.

So, if I just delete the AADS will everything else truck on as normal?

Siva-kumar-selvaraj 15,721 Reputation points

2021-07-06T06:11:48.27+00:00

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.
Thanks,

Accepted answer

1 additional answer

Your answer

Siva-kumar-selvaraj 15,721 Reputation points

2021-07-06T06:11:48.27+00:00

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.
Thanks,

Answer 1

Siva-kumar-selvaraj 15,721

Hello @PCCFIAU ,

Thanks for reaching out.

Yes, Azure AD Domain Services simply syncs with what is manages through the Microsoft 365 portal. A managed domain is configured to perform a one-way synchronization from Azure AD/M365 to provide access to a central set of users, groups, and credentials. You can create resources directly in the managed domain, but they aren't synchronized back to Azure AD.

When you delete a managed domain, the following steps occur and deletion is permanent and can't be reversed.

Domain controllers for the managed domain are de-provisioned and removed from the virtual network.
Data on the managed domain is deleted permanently. This data includes custom OUs, GPOs, custom DNS records, service principals, GMSAs, etc. that you created.
Machines joined to the managed domain lose their trust relationship with the domain and need to be unjoined from the domain.
-You can't sign in to these machines using corporate AD credentials. Instead, you must use the local administrator credentials for the machine.

More information : https://learn.microsoft.com/en-us/azure/active-directory-domain-services/delete-aadds

Hope this helps.

------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

JamesTran-MSFT 36,906 Reputation points Microsoft Employee Moderator

2021-07-07T23:54:52.91+00:00

@PCCFIAU
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

----------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.
Robert Young 26 Reputation points

2023-08-10T09:25:23.6666667+00:00

We have a similar situation in which we need to migrate our Azure ADDS from one subscription into another. As I understand it, this is not actually possible and to "migrate" we would need to delete the AZ ADDS currently deployed and then re-create it in the new subscription.

For context, we are moving away from a CSP managed Azure subscription onto an "in-house" instance.

My question is, the reference you make:

"Machines joined to the managed domain lose their trust relationship with the domain and need to be unjoined from the domain.
-You can't sign in to these machines using corporate AD credentials. Instead, you must use the local administrator credentials for the machine."

Does this apply in the case where we would be recreating the AZ ADDS within another subscription (within the same tenancy)? We have a large-ish number of devices that we could really do without having to remove and then rejoin the domain.

Answer 2

PCCFIAU 26

Thank you, I had no issues removing the ADDS.

Share via

Removing Azure AD Domain Services

1 additional answer

Your answer