Join a Windows Server VM to an Azure AD Domain Services managed domain (2023)

Azure Active Directory Domain Services (Azure AD DS) provides managed domain services that are fully compatible with Windows Server Active Directory, such as domain join, group policy, LDAP, Kerberos/NTLM authentication. With Azure AD DS managed domains, you can provide domain join functionality and management for virtual machines (VMs) in Azure. This tutorial shows you how to create a Windows Server VM and then join it to a managed domain.

In this tutorial, you will learn how to:

If you do not have an Azure subscription,create an accountbefore you start.

prerequisites

To complete this tutorial, you will need the following resources:

• A valid Azure subscription.
  • If you do not have an Azure subscription,create an account.
• The Azure Active Directory tenant associated with your subscription, synced with on-premises or cloud-only directories.
  • if necessary,Create an Azure Active Directory tenantorAssociate an Azure subscription with your account.
• An Azure Active Directory Domain Services managed domain enabled and configured in your Azure AD tenant.
  • if necessary,Create and configure an Azure Active Directory Domain Services managed domain.
• A user account that belongs to a managed domain.
  • Ensure that Azure AD Connect password hash synchronization or self-service password reset has been performed so that the account can log in to the managed domain.
• An Azure Bastion host deployed in an Azure AD DS virtual network.
  • if necessary,Create an Azure Bastion host.

If you already have a VM that you want to join the domain, skip to the section on joining the domainJoin the VM to a managed domain.

Sign in to the Azure portal

In this tutorial, you will create a Windows Server VM to join your managed domain using the Azure portal. To get started, please log inAzure Portal.

Create a Windows Server virtual machine

To see how to join a computer to a managed domain, let's create a Windows Server VM. This VM is connected to an Azure virtual network that provides connectivity to the managed domain. The process of joining a managed domain is the same as joining a regular on-premises Active Directory Domain Services domain.

If you already have a VM that you want to join the domain, skip to the section on joining the domainJoin the VM to a managed domain.

1. From the Azure portal menu or fromHomepage, selectCreate resources.

2. fromlet's start, chooseWindows Server 2016 Datacenter.

   

3. insidebasicwindow to configure the core settings of the virtual machine. keep the defaultavailability options,image, andsize.

   scope	suggested value
   resource group	Select or create a resource group such asmy resource group
   virtual machine name	Enter a name for the VM, such asmy virtual machine
   area	Select the region where you want to create the VM, e.g.Eastern US
   username	Enter the username of the local administrator account to be created on the VM, e.g.azure users
   password	Enter and confirm a secure password for the local administrator to create on the VM. Do not specify credentials for a domain user account.

4. By default, VMs created in Azure are accessible from the Internet using RDP. When RDP is enabled, auto-logon attacks are likely to occur, which may disable accounts with common names such asadministrativeoradministration staffFailed due to multiple consecutive login attempts.

   (Video) How to Join Azure VM to Azure AD Domain

   RDP should only be enabled when needed and limited to an authorized set of IP ranges. This configuration helps increase the security of the VM and reduces areas of potential attack. Alternatively, create and use an Azure Bastion host that only allows access through the Azure portal over TLS. In the next step of this tutorial, you will use an Azure Bastion host to securely connect to a VM.

   underpublic port of entry, choosenot any.

5. When done, selectNext: Disk.

6. from the drop down menuOS disk type, chooseStandard SSD, and selectNext step: networking.

   See Also

   Tutorial #3: Experiment and Train a Model Using Features (Preview) - Azure ML Managed Feature Store - BasicsTutorial: Azure Active Directory Single Sign-On (SSO) Integration with Jamf Pro - Microsoft EntraAzure AD Connect: Single Sign-On with SAML 2.0 Identity Provider - Azure - Microsoft Entra

7. Your VM must be connected to an Azure virtual network subnet that can communicate with the subnet your managed domain is deployed to. We recommend deploying managed domains into their own private subnets. Do not deploy VMs in the same subnet as the managed domain.

   There are two main methods of deploying VMs and connecting to appropriate virtual network subnets:

   • Create or select an existing subnet in the same virtual network as where the managed domain is deployed.
   • Select a subnet in the Azure virtual network to which it is connectedAzure virtual network peering.

   If you select a virtual network subnet that is not connected to a managed domain subnet, you cannot join the VM to the managed domain. For this tutorial, let's create a new subnet in an Azure virtual network.

   insidenetworkingpane, select the virtual network where your managed domain is deployed, such asaaads-vnet

8. In this example, the existingaaads subnetShows that the managed domain is connected to. Do not connect your VMs to this subnet. To create a subnet for the VM, chooseManage subnet configuration.

   

9. In the left menu of the virtual network window, selectaddress space.Virtual networks are created using a single address space10.0.2.0/24, used by the default subnet. other subnets, such asworkloadOr Azure Bastion may already exist.

   Add additional IP address ranges to the virtual network. The size of this address range and the actual IP address range used depends on other network resources that have been deployed. The IP address range should not overlap with any existing address ranges in Azure or on-premises. Be sure to set the size of the IP address range large enough to accommodate the number of VMs you wish to deploy into the subnet.

   In the following example, the additional IP address range is10.0.5.0/24Added. When ready, selectsave.

   

10. Next, in the left menu of the virtual network window, selectsubnet, and select+ subnetAdd subnets.

11. choose+ subnet, then enter a name for the subnet, such asmanage.provide aAddress range (CIDR block), For example10.0.5.0/24.Ensure that this IP address range does not overlap with any other existing Azure or on-premises address ranges. Leave the other options at their defaults, and chooseOK.

    (Video) Deploy Azure AD Domain Service and Join a Server to the Domain

    

12. It takes a few seconds to create the subnet. Once created, selectXClose the Subnets window.

13. back tonetworkingpane to create a VM, select the subnet you created from the drop-down menu, e.g.manage.again, make sure to select the correct subnet and not deploy the VM in the same subnet as the managed domain.

14. forpublic IP, choosenot anyfrom the drop-down menu. When using Azure Bastion to connect to management in this tutorial, there is no need to assign a public IP address to the VM.

15. Leave the other options at their defaults, and choosemanage.

16. putguided diagnosisarriveleave.Leave other options as default, and selectreview + create.

17. Review the VM settings, and selectcreate.

It takes a few minutes for the VM to be created. The Azure portal shows the deployment status. When the VM is ready, selectgo to resource.

Connect to a Windows Server virtual machine

To connect securely to your VMs, use an Azure Bastion host. Using Azure Bastion, deploy managed hosts into a virtual network and provide web-based RDP or SSH connectivity to VMs. The VM does not require a public IP address, nor does it need to have network security group rules open for external remote traffic. Connect to the VM using the Azure portal from a web browser. if necessary,Create an Azure Bastion host.

To connect to your VM using a Bastion host, complete the following steps:

1. insideoverviewpane for the VM, selectconnect, Thenfortress.

   

2. Enter the VM credentials you specified in the previous section, and selectconnect.

   

Allow your web browser to open a pop-up window to display the Bastion connection, if desired. It takes a few seconds to connect to the VM.

Join the VM to a managed domain

With the VM created and a web-based RDP connection established using Azure Bastion, let's now join the Windows Server virtual machine to the managed domain. The process is the same as for a computer connected to a regular on-premises Active Directory Domain Services domain.

1. ifserver manageris not turned on by default when you log into the VM, selectstartmenu, then chooseserver manager.

2. in the left paneserver managerwindow, chooselocal server.undercharacteristicIn the right pane, selectwork group.

   

3. insidesystem propertywindow, chooseChangeJoin a hosted domain.

   

4. insidefieldbox, specify the name of your hosted domain, such asaaddscontoso.com, and selectOK.

   

5. Enter your domain credentials to join the domain. Provide credentials for a user belonging to the managed domain. The account must be part of a managed domain or Azure AD tenant - accounts from external directories associated with an Azure AD tenant will not authenticate correctly during the domain join process.

   Account credentials can be specified in one of the following ways:

   • UPN format(Recommended) - Enter the User Principal Name (UPN) suffix for the user account, as configured in Azure AD. For example, the user's UPN suffixcontosoadminwillcontosoadmin@aaddscontoso.onmicrosoft.com.There are several common use cases where the UPN format can be reliably used to log into domains other thanSAM accountFormat:
     • If the user has a long UPN prefix, such asDiha is really a long name, thisSAM accountMay be auto-generated.
     • If multiple users have the same UPN prefix in your Azure AD tenant, for exampleDee, TheirSAM accountFormatting may be automatically generated.
   • SAMAccountName format- Enter an account name inSAM accountFormat. For example,SAM accountuserscontosoadminwillAADDSCONTOSO\contosoadmin.

6. Joining a hosted domain takes a few seconds. Once complete, the following message welcomes you to the domain:

   

   chooseOKGo on.

7. To complete the process of joining the managed domain, restart the VM.

After the Windows Server VM restarts, any policies applied in the managed domain are pushed to the VM. You can also now log in to Windows Server VMs using the appropriate domain credentials.

clean up resources

In the next tutorial, you'll use this Windows Server VM to install management tools that let you manage managed domains. If you do not wish to continue with this tutorial series, please review the following cleanup steps todelete virtual machine.otherwise,continue to next tutorial.

Unjoin a VM from a managed domain

To remove a VM from a managed domain, follow these steps again toJoin the VM to the domain.Do not join the managed domain, but choose to join a workgroup, such as the defaultwork group. After the VM restarts, the computer object is removed from the managed domain.

if youdelete virtual machineAn orphaned computer object remains in Azure AD DS if it is not detached from the domain.

delete virtual machine

If you do not intend to use this Windows Server VM, use the following steps to delete the VM:

1. Select from the menu on the leftresource group
2. Select your resource group, e.g.my resource group.
3. Select your virtual machine, e.g.my virtual machine, and selectdelete.chooseYesConfirm resource deletion. Deleting the VM takes a few minutes.
4. When deleting a virtual machine, select the OS disk, NIC, and any otherMy virtual machine -prefixes and remove them.

Troubleshoot domain join issues

The Windows Server VM should successfully join the managed domain just like a normal local computer would join an Active Directory Domain Services domain. If the Windows Server VM is unable to join the managed domain, then there is a connection or credential related issue. Review the following troubleshooting sections to successfully join a hosted domain.

connection problem

If you are not prompted for credentials to join the domain, there is a connectivity issue. The VM cannot access managed domains on the virtual network.

After trying each troubleshooting step, try joining the Windows Server VM to the managed domain again.

• Verify that the VM is connected to the same virtual network with Azure AD DS enabled, or has a peer-to-peer network connection.
• Try to ping the DNS domain name of the hosting domain, such asping aaddscontoso.com.
  • If the ping request fails, try pinging the IP address of the managed domain, e.g.ping 10.0.0.4.The IP address of your environment is shown in thecharacteristicThe page that appears when you select a managed domain from the list of Azure resources.
  • If you can ping the IP address, but not the domain, DNS may not be configured correctly. Confirm that the managed domain's IP address is configured as the virtual network's DNS server.
• Try flushing the DNS resolver cache on the virtual machine withipconfig /flushdnsOrder.

Credentials related issues

If you get prompted for credentials to join the domain, but get an error after you enter those credentials, the VM is able to connect to the managed domain. The credentials you provide will not join the VM to the managed domain.

After trying each troubleshooting step, try joining the Windows Server VM to the managed domain again.

• Make sure the user account you specify belongs to a managed domain.
• Confirm that the account is part of a managed domain or Azure AD tenant. Accounts in external directories associated with Azure AD tenants are not properly authenticated during the domain join process.
• Try specifying the credentials using UPN format, e.g.contosoadmin@aaddscontoso.onmicrosoft.com.If you have many users in your tenant with the same UPN prefix, or if your UPN prefix is ​​too long, thenSAM accountYour account may be automatically generated. In these cases,SAM accountYour account may be in a different format than what you expect or use on your local domain.
• check you haveEnable password syncto your hosted domain. Without this configuration step, the required password hashes will not be present on the managed domain to properly authenticate your login attempts.
• Wait for the password sync to complete. When a user account's password is changed, Azure AD's automatic background synchronization updates the password in Azure AD DS. It will take some time before the password becomes available to join the domain.

Next step

In this tutorial, you learned how to:

To manage your managed domain, use the Active Directory Administrative Center (ADAC) to configure the management VM.