How To Add Trust for Azure AD or Azure AD DS to on-prem AD

Question

We have a bunch of Azure users that need access to on-prem AD resources.
I.e. we want user@mathieu.company .com to be able to access company.local resources without a separate company\user login.

Both our Azure AD and our on-prem are stable and I would like to avoid combining them with Azure AD Connect. Doubly so because we're planning on phasing out on-prem entirely within the next couple of years and it seems like there isn't an option to make Azure the master instead of on-prem. It seemed like the requirement was very simple, but I'm having a tough time creating an architecture in which our on-prem trusts Azure users.

I thought Azure AD DS would solve this because it creates a separate domain that our Azure users are automatically synced to, which could then be trusted by our on-prem.

This article
https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/identity/
mentions creating an Azure AD DS domain and joining it to an on prem forest. Linked to this architecture: https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/identity/adds-extend-domain

The first article also recommends creating a separate forest and letting on prem forest trust the Azure AD DS forest: https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/identity/adds-forest

However, digging deeper into these resources, they usually all discuss your Azure AD DS forest having a one-way outbound trust to the on-prem AD. I believe I would need the opposite (a one-way inbound trust to the on-prem). Is there a stable and reliable way to trust my Azure domain so I can let these cloud-only users access on-prem AD resources?

Answer 1

It looks like that AADDS supports only outbound trusts. You can't have AADDS users access on-prem resources.