0

We're considering moving our on-premise domain controllers to Azure, so we started testing Azure AD Domain services, we created VM in Azure, joined it to Azure Domain services, installed RSAT tools,but we noticed that only one Default domain controller policy is allowed, same for Domain controllers, policy, can anyone explain why Microsoft imposed such limitations, couldn't find answer Googling it. Thanks

Azure Default Domain GPO

1 Answer 1

1

This is correct. Azure AD DS is not intended to be a replacement for your on-premises domain controllers, and has a number of limitations that make doing so not recommended:

  • No Domain Admin Rights (only access to specific services)
  • Single instance, in a single region only (no DR)
  • Users sourced from AAD are restricted to a single OU

AAD DS was created as a means for people to lift and shift applications into Azure that required access to an LDAP AD server, and that is what the restrictions are designed around. The assumption is that you will still maintain an on-premises domain and sync this to AAD.

1
  • Thanks for your response.
    – overflowed
    Oct 31, 2019 at 10:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .