Our company has a small central office with about 8 staff where we manage 20+ small remote stores. Each remote store has 2-3 PCs running Windows 10. We do not need file sharing as we use G Suite. We do need central control of user authentication, group policies to lock down the PCs so no new software can be installed or modified, and the ability to remotely push out software.

Is this possible using Azure AD or Azure AD Directory Services or similar or will we need a full Windows Server with Active Directory using VPNs to connect all remote stores?


It depends how much control you need. As your using Windows 10 you have the option to join your machines to Azure AD, this would give you the centralised authentication.

AAD doesn't support group policy so for this you have two options. First intune and MDM, if you can use these and they provide what you need then you can stick with a cloud solution. If that's not suitable then you could look at AAD DS, which would give you full domain controllers running in Azure, but bear in mind there are significant limitations on what you can do with AAD DS. In particular you can only deploy it in a single region, and you can't move users created in AAD (or on prem AD) out of the default OU.

For software distribution, you could look at using Azure Automation DSC to do configuration management of your machines, or again look at AAD DS and Group Policy.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.