Install Azure ATP sensors on IaaS VM Domain Controller

binbing 

Yes, you can install a AATP sensor in IaaS.

https://docs.microsoft.com/en-us/azure-advanced-threat-protection/atp-technical-faq#can-azure-atp-monitored-domain-controllers-be-virtualized-on-your-iaas-solution

You will need to install the sensor on the DC, and follow the rest of our prerequisites.  

https://docs.microsoft.com/en-us/azure-advanced-threat-protection/atp-prerequisites

binbing yes , it is, as long as you can allocate the required resources, and open the needed ports to the endpoints as stated in the deployment docs...