My company has their entire user/group architecture in the cloud using Azure. We recently purchased a Windows 2016 Server machine and I have been asked to set it up so that we can use our Azure accounts. I need to do simple things like file sharing and set up a vpn. Now, I have been reading that Azure AD Connect is NOT an option for me: https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-existing-tenant

If I can not sync Azure AD users/groups to my new AD on the server, then what do I do? I do not want to create new accounts and have people give me their passwords. I have heard about Azure AD Domain Services, but it seems like I need to spin up a virtual machine on Azure with Windows Server 2016, but I do not think that would help my case, since my server is on-site! How do I join this local domain (I have not set it yet) to the Azure domain that already exists with all of our accounts and machines in its AD?

I have been pouring through this and am not sure what I should do:





Azure AD by itself is not a classic AD, you can't join machines to it in the same way as on prem AD. You can join Win 10 machines to it, but not server OS.

Your solution here is going to be Azure AD Domain Services, what this service does is extend Azure AD to provide full AD services (with some restrictions). It does not require you to spin up a new VM, it is a PaaS service, you just need to turn it on for your domain, it does however require an Azure vNet to be deployed into.

Once you do this you will have a full AD domain that your server 2016 machine can join, so long as the network that machine is on is connected to the vNet in Azure that you created for AAD DS (this can be VPN, Express Route etc.).

If that isn't feasible then you can use AAD connect sync, but you would have to recreate all your user accounts in your full AD and then sync up to AAD.

  • Sam, thanks for the quick response. So I install a vNet in my Azure portal, turn on Azure AD Domain Services, and have the local server use ExpressRoute to connect to the Azure AD Domain Services via the vNet? Right? I want to make sure I understand you. Also, will I set the domain on the local machine to its own unique name, or use the Azure domain that is already established, or will that be taken care of in the ExpressRoute/vNet settings? – Wazzy24 Mar 14 '18 at 21:38
  • To use AAD DS you would create a vNet in Azure and then you would enable AAD DS, when you do that it will ask for a vNet to use, you will specify the one you created. Once that completes you need to get your on prem server to talk to that vNet (express route, VPN etc), once that is done you can then join it to the domain as normal. – Sam Cogan Mar 14 '18 at 21:40
  • If you wanted to use AD sync and recreate the accounts then you would need to setup a domain control on prem (sounded like you wanted to use the server 2016 machine for that) then sync it up to AAD. Then any machines you wanted to join to the domain will talk to the on prem domain controller. To be honest the AAD DS option is probably simpler for you if you can sort out the connectivity. – Sam Cogan Mar 14 '18 at 21:41
  • Sam, thanks! I will try the AAD DS route. I hope to have this up and running tomorrow. One last question: Will myself and my users need to be using a VPN client to connect to the server once I have AAD DS established and connected? We jump around quite often and all of our machines are on a WORKGROUP. Will I need to change their settings to the domain of the Azure AD Domain Services? Since we log-in with username/password and all our users are hosted there, it is a little weird to me that our machines are not in the classic domain setting that I am used to. – Wazzy24 Mar 14 '18 at 22:52
  • I'm not entirely clear on your setup, but it sounds like your going to RDP onto the server 2016 box on prem? Assuming that is the case then you only need connectivity to that machine, no need for VPN to azure from your local machines. – Sam Cogan Mar 15 '18 at 7:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.