I have spend a lot of time on the internet getting to know Azure AD Domain Services, and now I know that in basically deploys a couple of Windows VM's to Azure running domain controllers, which are administered by Microsoft.
So, it's a real "AD domain", which I have limited access to. I need to do DNS settings in my VNET's in Azure and so on.
My big question is, is AAD DS designed / usable for client PC's at the customers office? Or do I need to set up a site-to-site VPN from office to the AAD DS subnet first?
I did find some articles that mention AAD DS is intended for managing Windows Server VM's within Azure, and not for client PC's, but these articles are somewhat outdated.
We know that we can join a Windows 10 PC to Azure AD with Azure domain join, but this does not give us the "management power" like a real domain with it's GPO does. We tried Intune, but I find it's very limited.
Could someone please explain to me if AAD DS is a good solution to manage Windows 10 client instead of products like Intune, or is it really intended to be used for management of "other" VM's within Azure?