Microsoft Entra Domain Services (Entra DS) provides domain services such as domain join, group policy, LDAP, and Kerberos/NTLM authentication without requiring you to run your own domain controllers. You create a managed domain using the Microsoft Entra admin center. First, choose a DNS name: you can use the built-in domain name or a custom routable name, but avoid non‑routable suffixes like .local. The domain prefix must be 15 characters or fewer and must not conflict with any existing DNS namespace. Next, select an Azure location and assign the managed domain to its own dedicated subnet—it should not share that subnet with other VMs or services. Finally, add administrative users to the AAD DC Administrators group so they can manage the domain. Before the domain can authenticate users, you must enable password hash synchronization. Users need to change their passwords to generate the correct hashes for NTLM and Kerberos authentication.
To keep the managed domain secure, you enforce policies that control how users sign in and how passwords behave. Conditional Access policies require extra security measures such as multi‑factor authentication (MFA) before a user can complete a sign‑in. All user accounts must comply with these policies before they are synchronized into Entra DS. You also define password policies within Entra DS that match your organization’s security rules. Password hashes from on‑premises Active Directory are synchronized to Entra DS so that users have the same credentials in both environments, and the same password policies apply everywhere.
User accounts, groups, and credentials move from your on‑premises Active Directory to Entra DS through Microsoft Entra Connect. You decide whether to synchronize all users and groups or only a selected set based on your needs. Regular synchronization updates keep the managed domain current with changes made in Microsoft Entra ID. You monitor these updates to catch any delays or mismatches in the replication process, ensuring that the user and group objects stay accurate across the hybrid environment.
A system architecture diagram showing how identity objects and password hashes flow one-way from on-premises AD DS through Microsoft Entra Connect to Microsoft Entra ID, and then automatically to the Entra DS managed domain. It also highlights how scoped filtering limits which users and groups are synchronized.
Applications that need LDAP access can use secure LDAP (LDAPS) instead of plain LDAP. To enable it, you upload a certificate to your managed domain. Then you configure network security groups (NSGs) to allow inbound traffic on TCP port 636, which is the port that secure LDAP uses. Regularly audit the NSG rules and update certificates as needed to maintain security compliance.
Eager to master hybrid server management? Discover how to administer Windows Server Hybrid Core Infrastructure on Azure, setting your path towards the Microsoft Certified: Azure Hybrid Infrastructure Administrator Associate certification!
Prepare and test your skills
Prepare and test your skills
You must choose a DNS name with a prefix of 15 characters or fewer that does not conflict with existing DNS namespaces, assign the managed domain to its own dedicated subnet in an Azure location, add administrative users to the AAD DC Administrators group, and enable password hash synchronization for user authentication.
You enforce Conditional Access policies, which can require measures like multi-factor authentication (MFA), and define password policies within Entra DS that match your organization's security rules. Password hashes from on-premises Active Directory are synchronized so the same credentials and policies apply.
User accounts, groups, and credentials are synchronized from on-premises Active Directory to Entra DS using Microsoft Entra Connect. You can choose to synchronize all users and groups or only a selected set, and regular synchronization updates keep the managed domain current with changes from Microsoft Entra ID.
You enable secure LDAP by uploading a certificate to your managed domain and then configuring network security groups (NSGs) to allow inbound traffic on TCP port 636. You should regularly audit the NSG rules and update certificates to maintain security compliance.
StudyCerts
StudyCerts