1

We have the following setup:

  • Office 365 on mycompany.com
  • AWS Route 53 as the DNS server for mycompany.com
  • Azure as the hosting provider

I'm creating a new set of servers on Azure and I used Azure Active Directory Domain Services so that we can log into the servers using our Office 365 credentials.

mysite.mycompany.com is set up as a CNAME record on AWS to point to mysite.northeurope.cloudapp.azure.com and there is a public IP address set up with that name in Azure which points to a public load balancer which distributes the traffic between the two servers called mysite-web1.mycompany.com and mysite-web2.mycompany.com.

The problem is that I can't access the website mysite.mycompany.com from the Azure virtual network even though I can access it externally.

I assume that this is because the Azure virtual network just uses the Azure AD servers to get the domain name and doesn't go to AWS at all. There is no server on the Azure virtual network called mysite.mycompany.com

So I have a number of questions:

  • Is there a way to make it work? I assume that I could just add the DNS name mysite.mycompany.com to AD DS but I'd rather not double maintain that info.
  • Is this set up a bad idea? Assuming that I can fix it am I just going to run into other problems using the same name for the internal and external domains.
Improve this question

3 Answers 3

Reset to default
2

This is the same issue that people face with non-Azure Active Directory Domain Services. You should not name your AD domain the same as your external website, because the DNS in your Active Directory will serve the IP addresses of your domain controllers.

This does not mean that you cannot log in with your Office 365 accounts, however. Your AD Domain Name does not need to match your UPN (User Principal Name). For example, your domain name could be corp.example.com and your domain NETBIOS name be corp but users still log in with [email protected] - because example.com is your UPN suffix.

Frankly the "correct" way out of the situation you're in right now to to tear down that Azure ADDS and start again using a different domain name. The only other option is to do a DNS delegation of mysite to point to your Route 53 name servers. That means creating a new delegation for every subdomain you need to point elsewhere.

Improve this answer
3
  • 1
    Thanks. Now that I have re-read the Azure ADDS documentation it does say to make sure that you don't choose a name that conflicts with "an existing cloud service with that name on the virtual network" although surely that shouldn't be limited to the virtual network - it would also cause a problem if any public web site on any hosting provider was in conflict.
    – Steve Kaye
    Aug 21, 2018 at 10:35
  • It turns out that I had to get rid of Azure ADDS in the end as I need Domain Admin rights in order to set up DFS. I've set up my own AD domain as azure.mycompany.com and, as suggested, set the UPN as mycompany,com
    – Steve Kaye
    Aug 21, 2018 at 10:40
  • @SteveKaye you can have domain admin rights on Azure AD DS. You just can't have Enterprise Admin rights. But glad you got it working in the end.
    – Mark Henderson
    Aug 21, 2018 at 12:42
0

Vnet do not use Azure AD servers to get domain name. There are no Azure AD domain servers (unless you talk about your own domain\dns servers in the same vnet that you are using).

I think you need conditional DNS forwarding to handle this scenario. Because both your dns services are "responsible" for the same zone.

Improve this answer
3
  • Azure do now provide domain services (azure.microsoft.com/en-gb/services/active-directory-ds) but they are essentially the same as if you'd done it yourself and created the DCs as VMs.
    – Steve Kaye
    Aug 2, 2018 at 12:31
  • I'll look into conditional DNS forwarding, thanks.
    – Steve Kaye
    Aug 2, 2018 at 12:31
  • thats a completely separate thing, managed domain was there for 2 years or something
    – 4c74356b41
    Aug 2, 2018 at 12:35
0

There are couple of test missing, at this point you haven't identify the issue.

  1. Are you able to access website using IP?

  2. From a machine in Azure that is using ADD DS, using PowerShell try the Resolve-DNSName and see it if gets to the right IP or get a NS server.

    Resolve-DnsName mysite.mycompany.com
Resolve-DnsName mysite.mycompany.com -Type CNAME
Resolve-DnsName mysite.mycompany.com -Type NS

    This will help you understand where to correct DNS issue, if it is a DNS issue.

Hope this helps.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .