1

We have the following setup:

  • Office 365 on mycompany.com
  • AWS Route 53 as the DNS server for mycompany.com
  • Azure as the hosting provider

I'm creating a new set of servers on Azure and I used Azure Active Directory Domain Services so that we can log into the servers using our Office 365 credentials.

mysite.mycompany.com is set up as a CNAME record on AWS to point to mysite.northeurope.cloudapp.azure.com and there is a public IP address set up with that name in Azure which points to a public load balancer which distributes the traffic between the two servers called mysite-web1.mycompany.com and mysite-web2.mycompany.com.

The problem is that I can't access the website mysite.mycompany.com from the Azure virtual network even though I can access it externally.

I assume that this is because the Azure virtual network just uses the Azure AD servers to get the domain name and doesn't go to AWS at all. There is no server on the Azure virtual network called mysite.mycompany.com

So I have a number of questions:

  • Is there a way to make it work? I assume that I could just add the DNS name mysite.mycompany.com to AD DS but I'd rather not double maintain that info.
  • Is this set up a bad idea? Assuming that I can fix it am I just going to run into other problems using the same name for the internal and external domains.
2

This is the same issue that people face with non-Azure Active Directory Domain Services. You should not name your AD domain the same as your external website, because the DNS in your Active Directory will serve the IP addresses of your domain controllers.

This does not mean that you cannot log in with your Office 365 accounts, however. Your AD Domain Name does not need to match your UPN (User Principal Name). For example, your domain name could be corp.example.com and your domain NETBIOS name be corp but users still log in with amy.smith@example.com - because example.com is your UPN suffix.

Frankly the "correct" way out of the situation you're in right now to to tear down that Azure ADDS and start again using a different domain name. The only other option is to do a DNS delegation of mysite to point to your Route 53 name servers. That means creating a new delegation for every subdomain you need to point elsewhere.

  • 1
    Thanks. Now that I have re-read the Azure ADDS documentation it does say to make sure that you don't choose a name that conflicts with "an existing cloud service with that name on the virtual network" although surely that shouldn't be limited to the virtual network - it would also cause a problem if any public web site on any hosting provider was in conflict. – Steve Kaye Aug 21 '18 at 10:35
  • It turns out that I had to get rid of Azure ADDS in the end as I need Domain Admin rights in order to set up DFS. I've set up my own AD domain as azure.mycompany.com and, as suggested, set the UPN as mycompany,com – Steve Kaye Aug 21 '18 at 10:40
  • @SteveKaye you can have domain admin rights on Azure AD DS. You just can't have Enterprise Admin rights. But glad you got it working in the end. – Mark Henderson Aug 21 '18 at 12:42
0

Vnet do not use Azure AD servers to get domain name. There are no Azure AD domain servers (unless you talk about your own domain\dns servers in the same vnet that you are using).

I think you need conditional DNS forwarding to handle this scenario. Because both your dns services are "responsible" for the same zone.

  • Azure do now provide domain services (azure.microsoft.com/en-gb/services/active-directory-ds) but they are essentially the same as if you'd done it yourself and created the DCs as VMs. – Steve Kaye Aug 2 '18 at 12:31
  • I'll look into conditional DNS forwarding, thanks. – Steve Kaye Aug 2 '18 at 12:31
  • thats a completely separate thing, managed domain was there for 2 years or something – 4c74356b41 Aug 2 '18 at 12:35
0

There are couple of test missing, at this point you haven't identify the issue.

  1. Are you able to access website using IP?
  2. From a machine in Azure that is using ADD DS, using PowerShell try the Resolve-DNSName and see it if gets to the right IP or get a NS server.

    Resolve-DnsName mysite.mycompany.com
    Resolve-DnsName mysite.mycompany.com -Type CNAME
    Resolve-DnsName mysite.mycompany.com -Type NS
    

    This will help you understand where to correct DNS issue, if it is a DNS issue.

Hope this helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.