I am currently hosting multiple production projects in Microsoft Azure. Each project is configured with a separate virtual network with two Windows VMs to act as web servers, and one server to act as domain controller. Security is essential in all environment so I have kept them totally isolated from one another.
I am going to create one additional virtual network which will serve as a management area, and I will connect this network to each other one with a site-to-site VPN tunnel. My goal is to use this management network as a base for centralized WSUS management, endpoint security management, GPO configuration, etc.
Would it be smart/secure to design it like this? I was thinking of having one Active Directory forest with the TLD in the management network, and each project network as a subdomain in the same forest.
Any suggestions and advice would be greatly appreciated as I attempt to plan out the best configuration. Keep in mind, it's not a problem for me to reconfigure the current project networks to fit into this new model.