Partilhar via

Step-By-Step: Enabling Azure AD Domain Services

  • Artigo

Azure AD Domain Services, currently in preview, is a managed domain service providing group policy enablement, LDAP and NTLM/Kerberos Authentication without need of a Domain Controller.  This service will allow you to manage your azure identities more affectively should you have a cloud-only Azure implementation. Azure AD Domain services can be deployed to the same virtual network your other IaaS workloads runs and can connect to Azure AD via a typical domain join.  A hybrid offering is also available enabling on-premises identities to sync to the cloud and use those along with the azure Iaas workloads

The following video explains the main features of Azure Active Directory Domain Services:

 

Today’s post while highlight steps on how to enable Azure AD Domain Services and how to configure it properly for cloud-only IaaS setup.

The Azure AD instance REBELADMIN has been created already and will be used for the demo.

aads1

 

STEP 1: Setup Azure Virtual Network

First we need to setup a new azure virtual network. The azure AD domain service instance also need to assign to the same virtual network as your other service run in order to integrate those resources. Lets get started.

1)    In Azure Classic Portal click on Networks option located on the left side

aads2

 

2)    Click on Create a Virtual Network aads3

 

3)    In wizard type the name for the virtual network, select the location and then click on the arrow button

aads4

 

4)    Click on the arrow button

NOTE: On the DNS Server and VPN Connectivity page we are not going to define any DNS servers as I will setup it in later time in this demo

aads5

 

5)    On the Virtual Network Address Spaces page the address space is displayed and you can either customize or in this example we will proceed with default (Select Checkmark button)

aads6

 

6)    The new virtual network is successfully created once completed

aads7

 

STEP 2: Enable Azure AD Domain Service

Next step is to enable the domain service now that the virtual network has been setup.

1)    Click on the Azure AD directory instance which needs to enable Azure AD Domain Service (Select New > App Services > Active Directory > Directory if not yet completed)

aads8

 

2)    Click Configure aads9

 

3)    Under Domain Services click Yes to enable the domain services

aads10

 

4)    DNS Domain name of domain services – This option to define the dns domain name. If you do not have domain setup you still can use default azure name which is ends up with onmicrosoft.com.
Connect domain service to this virtual network – in here you can define which virtual network domain service should assign to. I have selected the new virtual network created on previous step. Click on Save once the changes are completed.

aads11

 

5)    Wait until the service is activated and started which can take up to 30 minutes

aads12

 

6)    Record the reported DNS server IP address as this is important to add these in to virtual network in order to join servers to domain

aads13

 

STEP 3: Add DNS server details into Virtual Network

1)    Click on the virtual network where Azure AD domain service also associated with

aads14

 

2)    Click on configure and then add the DNS server info recorded previously

aads15

 

3)    Click on SAVE to submit the changes

 

STEP 4: Create an AAD DC Administrator group

It is important to note that you will not get domain admin or enterprise administrator privileges in regards to the AD instance as the Azure AD Domain service is a managed service. You are allowed to create an AAD DC Administrator group enabling all its members with administrator privileges to the domain join servers. This group will also be added to the administrators group within domain join servers. The Azure AD instance needs to be loaded again to enable this.

 

1)    Click on the relevant Azure AD instance.

aads16

 

2)    Click on Groups and then Add Group aads17

 

3)    In the Add Group window enter the group name as AAD DC Administrators and select Security for Group Type followed by clicking the checkmark button.

NOTE: You must name the group AAD DC Administrators using the same format to enable this group.

aads18

 

4)    Next add the members as you prefer

aads19

The configuration is now complete.

 

Next steps are to enable password synchronization to allow users to use their cooperate logins to log in to the domain. This will be detailed in my future post.