Terminology
Given the very similar terminology, let me set out the two things I am asking about...
Firstly, Azure Active Directory. This is the directory service that underpins o365. You can sync credentials into it and use it for SSO via SAML and a few other bits, but that is basically it.
Secondly, Azure Active Directory Domain Services. This is much closer to a ADDS as we know it since Windows 2000 (OUs, Group Policy, NTLM, etc.) but provided as-a-service. There are a bunch of limitations (no domain admin rights, no schema extensions, no direct access to DCs) but you can domain-join servers to it in the traditional manner.
Their names being so similar has made for very frustrating Google results when trying to get any information about how they might interact, hence my question here!
My Goal
My goal is to move as much as is possible to the Cloud. I already have Exchange and SharePoint moved via o365 and have my on-premise AD syncing with Azure AD. I want to move all my servers to Azure too and use Azure AD Domain Services rather than build my own DCs as Azure VMs. All of that seems achievable.
My critical requirement: I want a user that logs into their o365 mailbox to do so with the same credentials as they use to login to a server (or service running on a server) that is domain-joined to the Azure AD Domain Services domain.
My Question
How do I achieve that critical requirement?!
Do I 'extend' or 'Upgrade?' my Azure AD instance to an Azure AD DS instance? There doesn't seem to be any option to do so.
Do I somehow sync my Azure AD and Azure AD DS instance? Does this mean building a VM to run the AD Connect tool?
There seems to be almost nothing written on the topic (that I can find!) and so your insights are greatly appreciated!