0

I have spend a lot of time on the internet getting to know Azure AD Domain Services, and now I know that in basically deploys a couple of Windows VM's to Azure running domain controllers, which are administered by Microsoft.

So, it's a real "AD domain", which I have limited access to. I need to do DNS settings in my VNET's in Azure and so on.

My big question is, is AAD DS designed / usable for client PC's at the customers office? Or do I need to set up a site-to-site VPN from office to the AAD DS subnet first?

I did find some articles that mention AAD DS is intended for managing Windows Server VM's within Azure, and not for client PC's, but these articles are somewhat outdated.

We know that we can join a Windows 10 PC to Azure AD with Azure domain join, but this does not give us the "management power" like a real domain with it's GPO does. We tried Intune, but I find it's very limited.

Could someone please explain to me if AAD DS is a good solution to manage Windows 10 client instead of products like Intune, or is it really intended to be used for management of "other" VM's within Azure?

1

My big question is, is AAD DS designed / usable for client PC's at the customers office? Or do I need to set up a site-to-site VPN from office to the AAD DS subnet first?

Yes, we can join on-prem client PC to AAD DS, but we should setup a site-to-site VPN.

I did find some articles that mention AAD DS is intended for managing Windows Server VM's within Azure, and not for client PC's, but these articles are somewhat outdated.

You are right, AAD DS is different with on-prem DS. on-prem DS is better than AAD DS to manage PCs.

We know that we can join a Windows 10 PC to Azure AD with Azure domain join, but this does not give us the "management power" like a real domain with it's GPO does. We tried Intune, but I find it's very limited.

AAD does not have the feature same as GPO, but AAD DS has.

Could someone please explain to me if AAD DS is a good solution to manage Windows 10 client instead of products like Intune, or is it really intended to be used for management of "other" VM's within Azure?

No, AAD DS used for manage Azure VMs(server), not same as Intune.

  • Hi, so if I want to manage a Windows 10 client via AAD DS, I can no longer user Azure AD join? I will just add the client "the old fashioned way" to a "normal AD domain", which is hosted in Azure as a service? And to do this, the PC needs a site-to-site VPN/direct connection to this hosted domain controller in Azure? – Mbrouwer88 Jun 7 '17 at 11:02
  • @Mbrouwer88 you can deploy a VM install ADon it (on-prem or on Azure), then sync with Azure AD, and setup AAD DS with Azure AD. we should deploy a s2s VPN between Azure and on-prem, in this way, we can manage windows 10 client with AD, and manager Azure VMs with AAD DS. – Jason Ye Jun 7 '17 at 13:31
0

From a technical perspective, yes you can create a VPN connection to Azure and have your client machines joined to the AAD DS domain, it will work.

However, you should consider carefully whether this is the right thing to do. AAD DS was designed as a solution for lift and shift of applications from on premesis to Azure that needed a full AD Domain to work with. It was expected that the machines accessing AAD DS would be in Azure on the Azure network and so connectivity was not an issue.

If we then join on premises machines to AAD DS you are now reliant on your VPN connection (and the internet connecting it is using) or ExpressRoute for your authentication. If this goes down, your user authentication goes down (aside from some cached logons obviously). You need to be confident that either your connectivity to Azure is reliable, or that if it goes down you can cope, before you look at using this solution.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.