Deploy and Secure Entra Domain Services Instances
Creating and Configuring a Managed Domain
Microsoft Entra Domain Services (Entra DS) provides domain services such as domain join, group policy, LDAP, and Kerberos/NTLM authentication without requiring you to run your own domain controllers. You create a managed domain using the Microsoft Entra admin center. First, choose a DNS name: you can use the built-in domain name or a custom routable name, but avoid non‑routable suffixes like .local. The domain prefix must be 15 characters or fewer and must not conflict with any existing DNS namespace. Next, select an Azure location and assign the managed domain to its own dedicated subnet—it should not share that subnet with other VMs or services. Finally, add administrative users to the AAD DC Administrators group so they can manage the domain. Before the domain can authenticate users, you must enable password hash synchronization. Users need to change their passwords to generate the correct hashes for NTLM and Kerberos authentication.
Securing the Managed Domain with Conditional Access and Password Policies
To keep the managed domain secure, you enforce policies that control how users sign in and how passwords behave. Conditional Access policies require extra security measures such as multi‑factor authentication (MFA) before a user can complete a sign‑in. All user accounts must comply with these policies before they are synchronized into Entra DS. You also define password policies within Entra DS that match your organization’s security rules. Password hashes from on‑premises Active Directory are synchronized to Entra DS so that users have the same credentials in both environments, and the same password policies apply everywhere.
Managing Synchronization of User and Group Objects
User accounts, groups, and credentials move from your on‑premises Active Directory to Entra DS through Microsoft Entra Connect. You decide whether to synchronize all users and groups or only a selected set based on your needs. Regular synchronization updates keep the managed domain current with changes made in Microsoft Entra ID. You monitor these updates to catch any delays or mismatches in the replication process, ensuring that the user and group objects stay accurate across the hybrid environment.
StudyCerts
StudyCerts