We have an onsite server running windows server 2012 r2. We have DNS, DHCP and Active Directory running on this machine running as a domain controller.

About a year ago we signed up for office 365 and used ADD connect to populate 365 with usernames and password syncs from our on-premises domain.

All working fine!

The question is now, I want to run a new Server 2012 r2 instance in Azure and promote this as our domain controller and decommission our onsite server meaning we are then fully cloud based, with no onsite equipment.

What would be the best way to do this?

I am thinking site-to-site VPN, promote the new cloud VM and move all roles to the cloud VM and shut down the onsite sever. Then re-install ADD connect on the cloud VM for managing the 365 mailboxes and password syncs.

Is there a better (or easier) way to do this? We have SQL databases and software that will run on the cloud instance, and having active directory and a real domain controller is definelfy a requirement.

Thanks in advance!

  • Are your local workstations on the domain? What are you planning on using locally for DHCP and DNS as well? – Rex Oct 26 '16 at 22:06
  • Our offices are a combination of remote users and office based users, therefore we will keep the VPN link up to azure in the main office (and use a Cisco DHCP/DNS server onsite). – Eros2016 Oct 27 '16 at 7:50
  • Remote users will have access to azure file shares and RDP into VMs running SQL software, so in theory we don't need DNS/DHCP in azure, just the domain/active directory. Thanks! – Eros2016 Oct 27 '16 at 7:51

Azure does not support on-premises DHCP server, so definitely something you won't be migrating to the cloud.

There's no easy way, although, in my opinion, it's easy enough. You have to follow the steps you just mentioned:

  1. Setup VPN (guide)
  2. Configure Azure VNet DNS server (On-premises DC)
  3. Install a replica AD DC in Azure VM (guide)
  4. Reconfigure Azure VNet DNS server (guide)
  5. Reboot Azure AD Connect VM to renew network settings - It shouldn't stop working as it will automatically use any available DC in the forest.
  6. Demote on-premises DC (guide)

Alternatively, for things like authentication and simple GPOs you can use Azure AD DS. It won't use your on-premises domain tho, it will use the users and groups from your Azure AD, but it creates a new domain separated from your on-premises Azure AD.


  • I would probably recommend using an external time source on the DC as well. – Jesus Shelby Oct 27 '16 at 1:20
  • Hi Bruno, thanks for your detailed response. I will configure the VPN, promote the azure VM and demote the onsite server entirely. We will use a Cisco DHCP/DNS server onsite so the cloud instance just needs to be a domain controller. Thanks for your advice! – Eros2016 Oct 27 '16 at 7:53
  • Great! As soon as you finish the migration and everything goes well for you don't forget to mark it as an answer. :) – Bruno Faria Oct 27 '16 at 10:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.