An organization is migrating a legacy line-of-business application from an on-premises datacenter to Azure Virtual Machines. The application has the following technical requirements: - Must authenticate users using traditional **Kerberos** or **NTLM** protocols - Virtual machines must support **domain join** and **Group Policy** management - The IT team wants to avoid deploying, managing, or patching dedicated Windows Server domain controllers in the cloud Which identity service should the organization implement to meet these requirements?

Microsoft Entra Domain Services: ### What Microsoft Entra Domain Services Is **Microsoft Entra Domain Services** provides managed domain services such as **domain join**, **Group Policy**, **Lightweight Directory Access Protocol (LDAP)**, and **Kerberos/NTLM authentication**. It enables organizations to run legacy applications in the cloud without requiring administrators to deploy, configure, backup, and patch traditional Windows Server **domain controllers (DCs)**. ### How It Meets the Requirements - **Legacy Protocol Support**: It offers native support for legacy authentication protocols such as **Kerberos** and **NTLM**, allowing lifted applications to function without code modifications. - **Virtual Machine Domain Join**: Azure Virtual Machines can be directly joined to the managed domain to receive centralized **Group Policy** objects. - **Zero Domain Controller Management**: The underlying domain controllers are fully managed and maintained by the Azure platform, removing administrative maintenance overhead. ### Key Advantages and Capabilities - **One-way synchronization** automatically replicates user accounts, group memberships, and credentials from **Microsoft Entra ID**. - **Lift-and-shift compatibility** allows migration of traditional directory-aware applications to Azure. - **High availability** is built-in with replica sets across Azure regions without manual replication configuration. - **Secure LDAP (LDAPS)** and DNS management are natively supported. ### Why This Is Optimal **Microsoft Entra Domain Services** is the ideal solution because standard **Microsoft Entra ID** relies on modern web-based authentication protocols (**OAuth 2.0**, **OpenID Connect**, **SAML**) and does not natively support Kerberos/NTLM or traditional machine domain joining.