Frequently asked questions (FAQs) about Azure Active Directory (AD) Domain Services

No. You can only create a single managed domain serviced by Azure AD Domain Services for a single Azure AD directory.

Classic virtual networks aren't supported for new deployments. Existing managed domains deployed in Classic virtual networks continue to be supported until they're retired on March 1, 2023. For existing deployments, you can migrate Azure AD Domain Services from the Classic virtual network model to Resource Manager.

For more information, see the official deprecation notice.

Yes. Azure AD Domain Services can be enabled in an Azure Resource Manager virtual network. Classic Azure virtual networks are no longer available when you create a managed domain.

Yes. For more information, see Migrate Azure AD Domain Services from the Classic virtual network model to Resource Manager.

Yes. For more information, see how to enable Azure AD Domain Services in Azure CSP subscriptions.

No. To authenticate users via NTLM or Kerberos, Azure AD Domain Services needs access to the password hashes of user accounts. In a federated directory, password hashes aren't stored in the Azure AD directory. Therefore, Azure AD Domain Services doesn't work with such Azure AD directories.

However, if you're using Azure AD Connect for password hash synchronization, you can use Azure AD Domain Services because the password hash values are stored in Azure AD.

The service itself doesn't directly support this scenario. Your managed domain is available in only one virtual network at a time. However, you can configure connectivity between multiple virtual networks to expose Azure AD Domain Services to other virtual networks. For more information, see how to connect virtual networks in Azure using VPN gateways or virtual network peering.

Yes. For more information, see how to enable Azure AD Domain Services using PowerShell.

Yes, you can create an Azure AD Domain Services managed domain using a Resource Manager template. A service principal and Azure AD group for administration must be created using the Azure portal or Azure PowerShell before the template is deployed. For more information, see Create an Azure AD DS managed domain using an Azure Resource Manager template. When you create an Azure AD Domain Services managed domain in the Azure portal, there's also an option to export the template for use with additional deployments.

No. The domain provided by Azure AD Domain Services is a managed domain. You don't need to provision, configure, or otherwise manage domain controllers for this domain. These management activities are provided as a service by Microsoft. Therefore, you can't add additional domain controllers (read-write or read-only) for the managed domain.

No. Guest users invited to your Azure AD directory using the Azure AD B2B invite process are synchronized into your Azure AD Domain Services managed domain. However, passwords for these users aren't stored in your Azure AD directory. Therefore, Azure AD Domain Services has no way to synchronize NTLM and Kerberos hashes for these users into your managed domain. Such users can't sign in or join computers to the managed domain.

No. A managed domain resource forest supports up to five one-way outbound forest trusts to on-premises forests.

After you create an Azure AD Domain Services managed domain, you can't move it to a different subscription, resource group, or region. As a workaround, you can delete the managed domain by using PowerShell or the Azure portal and re-create it with your desired setup. No restore operations can be provided while the managed domain is re-created.

No. After you create an Azure AD Domain Services managed domain, you can't change the DNS domain name. Choose the DNS domain name carefully when you create the managed domain. For considerations when you choose the DNS domain name, see the tutorial to create and configure an Azure AD Domain Services managed domain.

Yes. Each Azure AD Domain Services managed domain includes two domain controllers. You don't manage or connect to these domain controllers, they're part of the managed service. If you deploy Azure AD Domain Services into a region that supports Availability Zones, the domain controllers are distributed across zones. In regions that don't support Availability Zones, the domain controllers are distributed across Availability Sets. You have no configuration options or management control over this distribution. For more information, see Availability options for virtual machines in Azure.

No. You don't have permissions to connect to domain controllers for the managed domain using Remote Desktop. Members of the AAD DC Administrators group can administer the managed domain using AD administration tools such as the Active Directory Administration Center (ADAC) or AD PowerShell. These tools are installed using the Remote Server Administration Tools feature on a Windows server joined to the managed domain. For more information, see Create a management VM to configure and administer an Azure AD Domain Services managed domain.

Any user account that's part of the managed domain can join a VM. Members of the AAD DC Administrators group are granted remote desktop access to machines that have been joined to the managed domain.

No. You aren't granted administrative privileges on the managed domain. Domain Administrator and Enterprise Administrator privileges aren't available for you to use within the domain. Members of the domain administrator or enterprise administrator groups in your on-premises Active Directory are also not granted domain / enterprise administrator privileges on the managed domain.

Users and groups that are synchronized from Azure Active Directory to Azure AD Domain Services cannot be modified because their source of origin is Azure Active Directory. This includes moving users or groups from the AADDC Users managed organizational unit to a custom organizational unit. Any user or group originating in the managed domain may be modified.

Changes made in your Azure AD directory using either the Azure AD UI or PowerShell are automatically synchronized to your managed domain. This synchronization process runs in the background. There's no defined time period for this synchronization to complete all the object changes.

No. The schema is administered by Microsoft for the managed domain. Schema extensions aren't supported by Azure AD Domain Services.

Yes. Members of the AAD DC Administrators group are granted DNS Administrator privileges to modify DNS records in the managed domain. Those users can use the DNS Manager console on a machine running Windows Server joined to the managed domain to manage DNS. To use the DNS Manager console, install DNS Server Tools, which are part of the Remote Server Administration Tools optional feature on the server. For more information, see Administer DNS in an Azure AD Domain Services managed domain.

The default password lifetime on an Azure AD Domain Services managed domain is 90 days. This password lifetime is not synchronized with the password lifetime configured in Azure AD. Therefore, you may have a situation where users' passwords expire in your managed domain, but are still valid in Azure AD. In such scenarios, users need to change their password in Azure AD and the new password will synchronize to your managed domain. If you want to change the default password lifetime in a managed domain, you can create and configure custom password policies..

Additionally, the Azure AD password policy for DisablePasswordExpiration is synchronized to a managed domain. When DisablePasswordExpiration is applied to a user in Azure AD, the UserAccountControl value for the synchronized user in the managed domain has DONT_EXPIRE_PASSWORD applied.

When users reset their password in Azure AD, the forceChangePasswordNextSignIn=True attribute is applied. A managed domain synchronizes this attribute from Azure AD. When the managed domain detects forceChangePasswordNextSignIn is set for a synchronized user from Azure AD, the pwdLastSet attribute in the managed domain is set to 0, which invalidates the currently set password.

Yes. Five invalid password attempts within 2 minutes on the managed domain cause a user account to be locked out for 30 minutes. After 30 minutes, the user account is automatically unlocked. Invalid password attempts on the managed domain don't lock out the user account in Azure AD. The user account is locked out only within your Azure AD Domain Services managed domain. For more information, see Password and account lockout policies on managed domains.

No. Distributed File System (DFS) and replication aren't available when using Azure AD Domain Services.

Domain controllers in a managed domain automatically apply required Windows updates. There's nothing for you to configure or administer here. Make sure you don't create network security group rules that block outbound traffic to Windows Updates. For your own VMs joined to the managed domain, you are responsible for configuring and applying any required OS and application updates.

It is possible that during the maintenance of domain controllers there is a change in their names. To avoid problems with this type of change, it is recommended to not use the names of the domain controllers hardcoded in applications and/or other domain resources, but the FQDN of the domain. This way, no matter what the names of the domain controllers are, you won't need to reconfigure anything after a name change.

Yes. For more information, see the pricing page.

Azure AD Domain Services is included in the free trial for Azure. You can sign up for a free one-month trial of Azure.

No. Once you've enabled an Azure AD Domain Services managed domain, the service is available within your selected virtual network until you delete the managed domain. There's no way to pause the service. Billing continues on an hourly basis until you delete the managed domain.

Yes, to provide geographical resiliency for a managed domain, you can create an additional replica set to a peered virtual network in any Azure region that supports Azure AD DS. Replica sets share the same namespace and configuration with the managed domain.

No. Azure AD Domain Services is a pay-as-you-go Azure service and isn't part of EMS. Azure AD Domain Services can be used with all editions of Azure AD (Free and Premium). You're billed on an hourly basis, depending on usage.

No. Azure AD Domain Services has a single-domain, single-forest design, and you can't create child domains.

Refer to the Azure Services by region page to see a list of the Azure regions where Azure AD Domain Services is available.

Troubleshooting

Refer to the Troubleshooting guide for solutions to common issues with configuring or administering Azure AD Domain Services.

Next steps

To learn more about Azure AD Domain Services, see What is Azure Active Directory Domain Services?.

To get started, see Create and configure an Azure Active Directory Domain Services managed domain.