0

We want to completely get rid of our on-premise infrastructure.

We would like our employees to have a company laptop at home that could authenticate to the AAD DS and be managed by our IT staff through GPOs/Intune.

The documentation I see always suppose there is an on-prem AD to synch with when using AAD DS. This would not be our case. We would like the machines to join the AAD DS domain and be managed from there without any on-prem DC.

Would that work or there are some limitations in using only AAD DS in this scenario?

1 Answer 1

2

You can have AADDS running on cloud only mode without having an on prem infrastructure: https://docs.microsoft.com/en-us/azure/active-directory-domain-services/scenarios#azure-ad-ds-for-cloud-only-organizations

AADDS was designed to support cloud only workloads, it was not intended to replace an on-prem AD setup, there are some limitations you should be aware of: https://docs.microsoft.com/en-us/azure/active-directory-domain-services/compare-identity-solutions

Mainly, you need to have a line of sight between your laptops and the AADDS using VPN.

If you're using Intune already, I'd drop the AADDS idea and just go with modern authentication using AAD and device management using Intune.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .