Home
%3CLINGO-SUB%20id%3D%22lingo-sub-917392%22%20slang%3D%22en-US%22%3EHow%20to%20deal%20with%20Active%20Directory%20dependencies%20when%20moving%20workloads%20to%20the%20cloud.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-917392%22%20slang%3D%22en-US%22%3E%3CP%3EI%20met%20with%20some%20customers%20last%20week%2C%20and%20we%20had%20a%20great%20conversation%20about%20Active%20Directory%20and%20the%20differences%20between%20all%20the%20flavours%20available%20to%20them%20when%20adopting%20a%20hybrid%20posture.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EMore%20specifically%2C%20what%20are%20the%20difference%20between%3A%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Factive-directory%2Ffundamentals%2Factive-directory-whatis%3FWT.mc_id%3DITOPSTALK-BLOG-PIERRER%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EAzure%20Active%20Directory%3C%2FA%3E%20(AAD)%3C%2FLI%3E%0A%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Factive-directory-domain-services%2Foverview%3FWT.mc_id%3DITOPSTALK-BLOG-PIERRER%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EAzure%20Active%20Directory%20Domain%20Services%3C%2FA%3E%20(AADDS)%3C%2FLI%3E%0A%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fwindows-server%2Fidentity%2Fad-ds%2Fget-started%2Fvirtual-dc%2Factive-directory-domain-services-overview%3FWT.mc_id%3DITOPSTALK-BLOG-PIERRER%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EActive%20Directory%3C%2FA%3E%20(AD)%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3EIt's%20essential%20to%20understand%20the%20differences%20when%20you%E2%80%99re%20looking%20at%20a%20%E2%80%9Clift-and-shift%E2%80%9D%20scenario%20from%20on-prem%20to%20IaaS.%26nbsp%3B%20If%20you%20are%20moving%20to%20the%20cloud%20by%20subscribing%20to%20SaaS%20applications%20or%20rewriting%20existing%20applications%20using%20modern%20PaaS%20services%2C%20you%E2%80%99ll%20want%20to%20take%20advantage%20of%20Azure%20Active%20Directory%20(AAD).%20AAD%20is%20our%20cloud-based%20identity%20solution%20that%20allows%20you%20to%20leverage%20users%2C%20groups%2C%20applications%20and%20security%20principal%20concepts.%20It%20supports%20web-based%20OAuth%202.0%2C%20SAML%202.0%20and%20Open%20ID%20authentication%20frameworks.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EHowever%2C%20AAD%20does%20not%20have%20capabilities%20like%20Group%20Policies%20or%20Application%20Containers%20or%20extensible%20schema%2C%20which%20is%20sometimes%20required%20by%20some%20workloads%2C%20among%20other%20capabilities.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWhen%20%22lifting%20and%20shifting%22%20applications%20to%20the%20cloud%2C%20there%20are%20a%20lot%20of%20identity%20needs%20that%20may%20be%20required%2C%20do%20they%20use%20AD%20services%3F%20Does%20the%20workload%20need%20a%20service%20account%20managed%20by%20AD%20both%20on-prem%20and%20in%20IaaS%3F%20Does%20the%20workload%20need%20to%20Extend%20the%20AD%20schema%3F%20Does%20the%20application%20need%20access%20to%20an%20Application%20Partition%20in%20AD%3F%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20729px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F138129i08AFB199483AE3DA%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22clipboard_image_0.png%22%20title%3D%22clipboard_image_0.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EYou%20need%20to%20know%20your%20apps%20and%20how%20they%20interact%20with%20AD.%26nbsp%3B%20Once%20that%20is%20known%2C%20you%20can%20now%20decide%20if%20you%20will%20use%20one%20of%20the%20two%20remaining%20options%2C%20namely%20AD%20or%20AADDS%2C%20you%20can%20use%20to%20support%20your%20workload.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EHere%20are%20some%20of%20the%20differences%20you%20need%20to%20keep%20in%20mind.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CTABLE%20style%3D%22height%3A%20534px%3B%22%20width%3D%22850%22%3E%0A%3CTHEAD%3E%0A%3CTR%20style%3D%22height%3A%2030px%3B%22%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20400px%3B%22%3E%3CP%3E%3CSTRONG%3EFeature%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20213px%3B%20text-align%3A%20center%3B%22%3E%3CP%3E%3CSTRONG%3EAADDS%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20236px%3B%20text-align%3A%20center%3B%22%3E%3CP%3E%3CSTRONG%3EAD%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3C%2FTHEAD%3E%0A%3CTBODY%3E%0A%3CTR%20style%3D%22height%3A%2030px%3B%22%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20400px%3B%22%3E%3CP%3EManaged%20service%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20213px%3B%20text-align%3A%20center%3B%22%3E%3CP%3E%3CSTRONG%3E%E2%9C%93%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20236px%3B%20text-align%3A%20center%3B%22%3E%3CP%3E%3CSTRONG%3E%E2%9C%95%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%20style%3D%22height%3A%2030px%3B%22%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20400px%3B%22%3E%3CP%3ESecure%20deployments%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20213px%3B%20text-align%3A%20center%3B%22%3E%3CP%3E%3CSTRONG%3E%E2%9C%93%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20236px%3B%20text-align%3A%20center%3B%22%3E%3CP%3EYou%20secure%20the%20deployment%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%20style%3D%22height%3A%2030px%3B%22%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20400px%3B%22%3E%3CP%3EDNS%20server%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20213px%3B%20text-align%3A%20center%3B%22%3E%3CP%3E%3CSTRONG%3E%E2%9C%93%20%3C%2FSTRONG%3E%26nbsp%3B(managed%20service)%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20236px%3B%20text-align%3A%20center%3B%22%3E%3CP%3E%3CSTRONG%3E%E2%9C%93%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%20style%3D%22height%3A%2030px%3B%22%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20400px%3B%22%3E%3CP%3EDomain%20or%20Enterprise%20administrator%20privileges%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20213px%3B%20text-align%3A%20center%3B%22%3E%3CP%3E%3CSTRONG%3E%E2%9C%95%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20236px%3B%20text-align%3A%20center%3B%22%3E%3CP%3E%3CSTRONG%3E%E2%9C%93%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%20style%3D%22height%3A%2030px%3B%22%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20400px%3B%22%3E%3CP%3EDomain%20join%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20213px%3B%20text-align%3A%20center%3B%22%3E%3CP%3E%3CSTRONG%3E%E2%9C%93%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20236px%3B%20text-align%3A%20center%3B%22%3E%3CP%3E%3CSTRONG%3E%E2%9C%93%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%20style%3D%22height%3A%2030px%3B%22%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20400px%3B%22%3E%3CP%3EDomain%20authentication%20using%20NTLM%20and%20Kerberos%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20213px%3B%20text-align%3A%20center%3B%22%3E%3CP%3E%3CSTRONG%3E%E2%9C%93%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20236px%3B%20text-align%3A%20center%3B%22%3E%3CP%3E%3CSTRONG%3E%E2%9C%93%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%20style%3D%22height%3A%2057px%3B%22%3E%0A%3CTD%20style%3D%22height%3A%2057px%3B%20width%3A%20400px%3B%22%3E%3CP%3EKerberos%20constrained%20delegation%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22height%3A%2057px%3B%20width%3A%20213px%3B%20text-align%3A%20center%3B%22%3E%3CP%3EResource-based%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22height%3A%2057px%3B%20width%3A%20236px%3B%20text-align%3A%20center%3B%22%3E%3CP%3EResource-based%20%26amp%3B%20account-based%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%20style%3D%22height%3A%2030px%3B%22%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20400px%3B%22%3E%3CP%3ECustom%20OU%20structure%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20213px%3B%20text-align%3A%20center%3B%22%3E%3CP%3E%3CSTRONG%3E%E2%9C%93%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20236px%3B%20text-align%3A%20center%3B%22%3E%3CP%3E%3CSTRONG%3E%E2%9C%93%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%20style%3D%22height%3A%2030px%3B%22%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20400px%3B%22%3E%3CP%3EGroup%20Policy%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20213px%3B%20text-align%3A%20center%3B%22%3E%3CP%3E%3CSTRONG%3E%E2%9C%93%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20236px%3B%20text-align%3A%20center%3B%22%3E%3CP%3E%3CSTRONG%3E%E2%9C%93%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%20style%3D%22height%3A%2030px%3B%22%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20400px%3B%22%3E%3CP%3ESchema%20extensions%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20213px%3B%20text-align%3A%20center%3B%22%3E%3CP%3E%3CSTRONG%3E%E2%9C%95%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20236px%3B%20text-align%3A%20center%3B%22%3E%3CP%3E%3CSTRONG%3E%E2%9C%93%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%20style%3D%22height%3A%2030px%3B%22%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20400px%3B%22%3E%3CP%3EAD%20domain%2Fforest%20trusts%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20213px%3B%20text-align%3A%20center%3B%22%3E%3CP%3E%3CSTRONG%3E%E2%9C%95%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20236px%3B%20text-align%3A%20center%3B%22%3E%3CP%3E%3CSTRONG%3E%E2%9C%93%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%20style%3D%22height%3A%2030px%3B%22%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20400px%3B%22%3E%3CP%3ESecure%20LDAP%20(LDAPS)%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20213px%3B%20text-align%3A%20center%3B%22%3E%3CP%3E%3CSTRONG%3E%E2%9C%93%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20236px%3B%20text-align%3A%20center%3B%22%3E%3CP%3E%E2%9C%93%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%20style%3D%22height%3A%2030px%3B%22%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20400px%3B%22%3E%3CP%3ELDAP%20read%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20213px%3B%20text-align%3A%20center%3B%22%3E%3CP%3E%3CSTRONG%3E%E2%9C%93%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20236px%3B%20text-align%3A%20center%3B%22%3E%3CP%3E%3CSTRONG%3E%E2%9C%93%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%20style%3D%22height%3A%2057px%3B%22%3E%0A%3CTD%20style%3D%22height%3A%2057px%3B%20width%3A%20400px%3B%22%3E%3CP%3ELDAP%20write%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22height%3A%2057px%3B%20width%3A%20213px%3B%20text-align%3A%20center%3B%22%3E%3CP%3E%3CSTRONG%3E%E2%9C%93%3C%2FSTRONG%3E%20%26nbsp%3B(within%20the%20managed%20domain)%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22height%3A%2057px%3B%20width%3A%20236px%3B%20text-align%3A%20center%3B%22%3E%3CP%3E%3CSTRONG%3E%E2%9C%93%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%20style%3D%22height%3A%2030px%3B%22%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20400px%3B%22%3E%3CP%3EGeo-distributed%20deployments%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20213px%3B%20text-align%3A%20center%3B%22%3E%3CP%3E%3CSTRONG%3E%E2%9C%95%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%20style%3D%22height%3A%2030px%3B%20width%3A%20236px%3B%20text-align%3A%20center%3B%22%3E%3CP%3E%3CSTRONG%3E%E2%9C%93%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3C%2FTBODY%3E%0A%3C%2FTABLE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId-1846120429%22%20id%3D%22toc-hId-1846176854%22%20id%3D%22toc-hId-1846176854%22%20id%3D%22toc-hId-1846176854%22%20id%3D%22toc-hId-1846176854%22%20id%3D%22toc-hId-1846176854%22%20id%3D%22toc-hId-1846176854%22%20id%3D%22toc-hId-1846176854%22%20id%3D%22toc-hId-1846176854%22%20id%3D%22toc-hId-1846176854%22%20id%3D%22toc-hId-1846176854%22%3EAzure%20Active%20Directory%20Domain%20Services%20(AADDS)%3C%2FH2%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F138133iB0796FD185120074%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22clipboard_image_2.png%22%20title%3D%22clipboard_image_2.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAzure%20Active%20Directory%20Domain%20Services%20(Azure%20AD%20DS)%20provides%20a%20managed%20domain%20services%20with%20a%20subset%20of%20fully%20compatible%20traditional%20AD%20DS%20features%20such%20as%20domain%20join%2C%20group%20policy%2C%20LDAP%2C%20and%20Kerberos%20%2F%20NTLM%20authentication.%3C%2FP%3E%0A%3CP%3E%3CBR%20%2F%3EIt%20integrates%20with%20Azure%20AD%20and%2C%20when%20synchronized%20with%20an%20on-premises%20AD%20DS%20environment%2C%20allows%20you%20to%20extend%20your%20on-prem%20identities%20to%20run%20in%20Azure%20as%20part%20of%20a%20lift-and-shift%20strategy.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F138135iAD68BDCF9268EF40%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22clipboard_image_3.png%22%20title%3D%22clipboard_image_3.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIt%20all%20sounds%20wonderful%2C%20and%20it%20is%20in%20most%20cases.%26nbsp%3BHere%20are%20some%20pros%20and%20cons.%20(This%20list%20is%20my%20own%20opinion)%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId--706036532%22%20id%3D%22toc-hId--705980107%22%20id%3D%22toc-hId--705980107%22%20id%3D%22toc-hId--705980107%22%20id%3D%22toc-hId--705980107%22%20id%3D%22toc-hId--705980107%22%20id%3D%22toc-hId--705980107%22%20id%3D%22toc-hId--705980107%22%20id%3D%22toc-hId--705980107%22%20id%3D%22toc-hId--705980107%22%20id%3D%22toc-hId--705980107%22%3EPros%3C%2FH2%3E%0A%3CP%3EThe%20deployment%20of%20AADDS%20is%20relatively%20simple%20once%20you%20have%20your%20on-prem%20AD%20connected%20to%20AAD%20using%20Ad%20Connect.%26nbsp%3B%20It%20takes%20away%20the%20need%20for%20you%20to%20deploy%20your%20Domain%20Controllers%20in%20Azure%20and%20to%20ensure%20that%20your%20DCs%20are%20in%20different%20fault%20and%20update%20domains%2C%20and%20it%20takes%20care%20of%20the%20DC%20patching%20for%20you.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAADDS%20provides%20an%20experience%20that%20is%20fully%20compatible%20with%20a%20subset%20of%20features%20of%20Active%20Directory%20(see%20above).%26nbsp%3BDepending%20on%20your%20apps%2C%20they%20may%20keep%20running%20in%20the%20cloud%20without%20any%20modifications.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAs%20I%20mentioned%20since%20it's%20a%20managed%20Directory%20service%2C%20it%20is%20highly%20available%20the%20DCs%20and%20the%20AADDS%20will%20be%20automatically%20backed%20up.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EYou%20will%20not%20need%20to%20set%20up%20a%20site-to-site%20VPN%20or%20use%20ExpressRoute%20to%20facilitate%20the%20replication%20of%20self-managed%20regular%20AD%20domain%20controllers.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId-1036773803%22%20id%3D%22toc-hId-1036830228%22%20id%3D%22toc-hId-1036830228%22%20id%3D%22toc-hId-1036830228%22%20id%3D%22toc-hId-1036830228%22%20id%3D%22toc-hId-1036830228%22%20id%3D%22toc-hId-1036830228%22%20id%3D%22toc-hId-1036830228%22%20id%3D%22toc-hId-1036830228%22%20id%3D%22toc-hId-1036830228%22%20id%3D%22toc-hId-1036830228%22%3ECons%3C%2FH2%3E%0A%3CP%3EAADDS%20does%20support%20Group%20Policies.%26nbsp%3BHowever%2C%20there%20is%20no%20GPO%20replication%20from%20on-prem%3B%20you%20must%20recreate%20the%20policies%20you%20need%20in%20the%20managed%20directory%20service.%26nbsp%3BIf%20you%20change%20one%20on-prem%2C%20you%20must%20perform%20the%20same%20change%20in%20the%20managed%20Directory.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAD%20domain%2Fforest%20trusts%20are%20not%20supported%20at%20this%20point.%20(it's%20on%20the%20roadmap).%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThere%20are%20no%20capabilities%20for%20Geo-distributed%20deployments.%26nbsp%3B%20Your%20managed%20AADDS%20is%20limited%20to%20the%20virtual%20network%20on%20which%20you%20deployed%20it.%26nbsp%3BYou%20can%20go%20around%20that%20problem%20by%20setting%20up%20VPNs%20and%20peered%20virtual%20networks%2C%20but%20it%20adds%20considerably%20more%20complexity%20to%20your%20environments.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAs%20you%20can%20see%20in%20the%20diagram%20above%2C%26nbsp%3B%20the%20replication%20from%20your%20Azure%20AD%20tenant%20to%20AADDS%20is%20a%20one-way%20replication.%26nbsp%3B%20There%20are%20no%20facilities%20for%20LDAP%20writebacks%20outside%20of%20the%20managed%20domain%20in%20that%20virtual%20network%2C%20which%20means%20that%20the%20changes%20are%20NOT%20written%20back%20to%20the%20on-prem%20AD%20through%20the%20AD%20Connect%20sync%20process.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId--1515383158%22%20id%3D%22toc-hId--1515326733%22%20id%3D%22toc-hId--1515326733%22%20id%3D%22toc-hId--1515326733%22%20id%3D%22toc-hId--1515326733%22%20id%3D%22toc-hId--1515326733%22%20id%3D%22toc-hId--1515326733%22%20id%3D%22toc-hId--1515326733%22%20id%3D%22toc-hId--1515326733%22%20id%3D%22toc-hId--1515326733%22%20id%3D%22toc-hId--1515326733%22%3EActive%20Directory%20(AD)%20in%20IaaS%3C%2FH2%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EDeploying%20Active%20Directory%20in%20IaaS%20is%20virtually%20the%20same%20as%20setting%20it%20up%20in%20remote%20offices.%26nbsp%3B%20You%20need%20a%20connection%20(site-to-site%20VPN%20or%20ExpressRoute)%2C%20DCs%20deployed%20in%20each%20Virtual%20networks%2C%20defined%20sites%20in%20AD%20to%20managed%20replication%20and%20authentication%20requests.%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F138139i66623433D88AAA92%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22clipboard_image_4.png%22%20title%3D%22clipboard_image_4.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EThese%20are%20tasks%20that%20we%20all%20know%20and%20have%20been%20doing%20for%20years.%20It%20feels%20familiar.%26nbsp%3B%20It's%20comfortable%20and%20that's%20ok.%26nbsp%3B%20This%20design%20also%20has%20Pros%20and%20Cons.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId-227427177%22%20id%3D%22toc-hId-227483602%22%20id%3D%22toc-hId-227483602%22%20id%3D%22toc-hId-227483602%22%20id%3D%22toc-hId-227483602%22%20id%3D%22toc-hId-227483602%22%20id%3D%22toc-hId-227483602%22%20id%3D%22toc-hId-227483602%22%20id%3D%22toc-hId-227483602%22%20id%3D%22toc-hId-227483602%22%20id%3D%22toc-hId-227483602%22%3EPros%3C%2FH2%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAs%20I%20mentioned%2C%20it's%20familiar%20and%20comfortable.%26nbsp%3B%20It%20ensures%20that%20if%20an%20app%20worked%20on-prem%20it%20will%20still%20work%20once%20migrated%20to%20azure%2C%20the%20Application%20Partitions%2C%20the%20extended%20schema%2C%20the%20group%20policies%20will%20all%20be%20there.%26nbsp%3B%20Writebacks%20will%20occur%20natively%20without%20any%20duplicate%20work.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3Eyou%20are%20not%20limited%20to%20a%20single%20virtual%20network.%26nbsp%3B%20you%20can%20deploy%20as%20many%20sites%20as%20required%20anywhere%20in%20the%20world%20where%20Azure%20regions%20are%20found.%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId-1970237512%22%20id%3D%22toc-hId-1970293937%22%20id%3D%22toc-hId-1970293937%22%20id%3D%22toc-hId-1970293937%22%20id%3D%22toc-hId-1970293937%22%20id%3D%22toc-hId-1970293937%22%20id%3D%22toc-hId-1970293937%22%20id%3D%22toc-hId-1970293937%22%20id%3D%22toc-hId-1970293937%22%20id%3D%22toc-hId-1970293937%22%20id%3D%22toc-hId-1970293937%22%3ECons%3C%2FH2%3E%0A%3CP%3EIt's%20not%20a%20managed%20Directory%20Service%2C%20therefore%20you%20must%20take%20care%20of%20it.%26nbsp%3B%20Each%20additional%20domain%20Controller%20is%20another%20machine%20you%20must%20maintain%20and%20patch.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EYou%20must%20define%20where%20you%20deploy%20each%20DC%20to%20ensure%20availability.%20You%20must%20manage%20the%20backup%20and%20DR%20capabilities%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EVirtual%20Machines%20are%20typically%20more%20expensive%20than%20managed%20services%20(depending%20on%20how%20many%20Dcs%20you%20deploy%20and%20the%20size%20of%20the%20VMs)%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EYour%20environment%20is%20significantly%20more%20complex%20due%20to%20the%20VPN%2FExpressRoutes%20added%20VMs%20and%20custom%20DNS%20service.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId--581919449%22%20id%3D%22toc-hId--581863024%22%20id%3D%22toc-hId--581863024%22%20id%3D%22toc-hId--581863024%22%20id%3D%22toc-hId--581863024%22%20id%3D%22toc-hId--581863024%22%20id%3D%22toc-hId--581863024%22%20id%3D%22toc-hId--581863024%22%20id%3D%22toc-hId--581863024%22%20id%3D%22toc-hId--581863024%22%20id%3D%22toc-hId--581863024%22%3EConclusion.%3C%2FH2%3E%0A%3CP%3EThere%20is%20no%20right%20and%20wrong%20here.%26nbsp%3B%20Your%20design%20and%20directory%20choices%20are%20mandated%20by%20the%20workloads%20you%20are%20migrating.%26nbsp%3B%20Can%20they%20function%20adequately%20with%20AADDS%3F%26nbsp%3B%20do%20the%20absolutely%20require%20the%20full%20power%20of%20AD%3F%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThese%20are%20answers%20I%20cannot%20give%20you.%20You%20must%20find%20out%20for%20yourself.%20Do%20your%20due%20diligence%20before%20you%20start%20migrating.%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EI%20hope%20this%20helps%20define%20where%20you%20need%20to%20look%20and%20how%20you%20need%20to%20think%20about%20AD%20integration%20when%20adopting%20a%20hybrid%20posture%20in%20Azure.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ECheers!%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EPierre%20Roman%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-917392%22%20slang%3D%22en-US%22%3E%3CP%3EIf%20you%20are%20moving%2C%20building%2C%20or%20subscribing%20to%20apps%20in%20Azure%2C%20you%20need%20to%20understand%20which%20flavour%20of%20AD%20to%20use.%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Factive-directory%2Ffundamentals%2Factive-directory-whatis%3FWT.mc_id%3DITOPSTALK-BLOG-PIERRER%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%20target%3D%22_blank%22%3EAzure%20Active%20Directory%3C%2FA%3E%20(AAD)%3C%2FLI%3E%0A%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Factive-directory-domain-services%2Foverview%3FWT.mc_id%3DITOPSTALK-BLOG-PIERRER%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%20target%3D%22_blank%22%3EAzure%20Active%20Directory%20Domain%20Services%3C%2FA%3E%20(AADDS)%3C%2FLI%3E%0A%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fwindows-server%2Fidentity%2Fad-ds%2Fget-started%2Fvirtual-dc%2Factive-directory-domain-services-overview%3FWT.mc_id%3DITOPSTALK-BLOG-PIERRER%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%20target%3D%22_blank%22%3EActive%20Directory%3C%2FA%3E%20(AD)%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3ELet's%20discuss%20the%20differences.%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-917392%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EActive%20Directory%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EAzure%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EAzure%20Active%20Direcrtory%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EAzure%20Active%20Directory%20Domain%20Service%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EIT%20Cloud%20and%20Infrastructure%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EIT%20Pro%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EPierre%20Roman%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EWindows%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EWindows%20Server%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-918667%22%20slang%3D%22en-US%22%3ERe%3A%20What%20are%20the%20Differences%20Between%20Azure%20Active%20Directory%20and%20Azure%20Active%20Directory%20Domain%20Servic%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-918667%22%20slang%3D%22en-US%22%3E%3CP%3EThks%20for%20this%20very%20intresting%20Article.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-918705%22%20slang%3D%22en-US%22%3ERe%3A%20What%20are%20the%20Differences%20Between%20Azure%20Active%20Directory%20and%20Azure%20Active%20Directory%20Domain%20Servic%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-918705%22%20slang%3D%22en-US%22%3E%3CP%3EThanks%2C%20Pierre%20for%20sharing%20this%20article.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-918722%22%20slang%3D%22en-US%22%3ERe%3A%20What%20are%20the%20Differences%20Between%20Azure%20Active%20Directory%20and%20Azure%20Active%20Directory%20Domain%20Servic%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-918722%22%20slang%3D%22en-US%22%3E%3CP%3ENice%20article.%20Thank%20you.%3C%2FP%3E%3CP%3ECan%20ADDS%20be%20used%20for%20setting%20up%20windows%20services%20like%20ADFS%20which%20needs%26nbsp%3B%3CSPAN%3EDomain%20administrator%20privileges%20as%20you%20mentioned%20ADDS%20does%20not%20have%26nbsp%3BDomain%20or%20Enterprise%20administrator%20privileges%20feature%3F%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-918901%22%20slang%3D%22en-US%22%3ERe%3A%20What%20are%20the%20Differences%20Between%20Azure%20Active%20Directory%20and%20Azure%20Active%20Directory%20Domain%20Servic%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-918901%22%20slang%3D%22en-US%22%3E%3CDIV%20class%3D%22lia-message-author-avatar%20lia-component-author-avatar%20lia-component-message-view-widget-author-avatar%20UserAvatarWrapper%22%20style%3D%22box-sizing%3A%20border-box%3B%20color%3A%20%23333333%3B%20display%3A%20inline-block%3B%20float%3A%20left%3B%20font-family%3A%20%26amp%3Bquot%3B%20segoeui%26amp%3Bquot%3B%2C%26amp%3Bquot%3Blato%26amp%3Bquot%3B%2C%26amp%3Bquot%3Bhelvetica%20neue%26amp%3Bquot%3B%2Chelvetica%2Carial%2Csans-serif%3B%20font-size%3A%2014px%3B%20font-style%3A%20normal%3B%20font-variant%3A%20normal%3B%20font-weight%3A%20300%3B%20letter-spacing%3A%20normal%3B%20orphans%3A%202%3B%20padding-right%3A%2010px%3B%20position%3A%20relative%3B%20text-align%3A%20left%3B%20text-decoration%3A%20none%3B%20text-indent%3A%200px%3B%20text-transform%3A%20none%3B%20-webkit-text-stroke-width%3A%200px%3B%20white-space%3A%20normal%3B%20word-spacing%3A%200px%3B%22%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F428813%22%20target%3D%22_blank%22%3E%40Abhishek_j%3C%2FA%3E%20ADDS%20is%20Active%20Directory%20Domain%20Services....%26nbsp%3B%20so%20yes%2C%20you%20can%20use%20it%20to%20setup%20ADFS.%26nbsp%3B%20Azure%26nbsp%3BActive%20Directory%20Domain%20Services%20or%20AADDS%20%2C%20no.%3C%2FDIV%3E%0A%3CDIV%20class%3D%22lia-message-author-with-avatar%22%20style%3D%22box-sizing%3A%20border-box%3B%20color%3A%20%23333333%3B%20display%3A%20inline-block%3B%20font-family%3A%20%26amp%3Bquot%3B%20segoeui%26amp%3Bquot%3B%2C%26amp%3Bquot%3Blato%26amp%3Bquot%3B%2C%26amp%3Bquot%3Bhelvetica%20neue%26amp%3Bquot%3B%2Chelvetica%2Carial%2Csans-serif%3B%20font-size%3A%2014px%3B%20font-style%3A%20normal%3B%20font-variant%3A%20normal%3B%20font-weight%3A%20300%3B%20letter-spacing%3A%20normal%3B%20orphans%3A%202%3B%20padding-top%3A%2010px%3B%20text-align%3A%20left%3B%20text-decoration%3A%20none%3B%20text-indent%3A%200px%3B%20text-transform%3A%20none%3B%20vertical-align%3A%20top%3B%20-webkit-text-stroke-width%3A%200px%3B%20white-space%3A%20normal%3B%20word-spacing%3A%200px%3B%22%3E%26nbsp%3B%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-919654%22%20slang%3D%22en-US%22%3ERe%3A%20What%20are%20the%20Differences%20Between%20Azure%20Active%20Directory%20and%20Azure%20Active%20Directory%20Domain%20Servic%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-919654%22%20slang%3D%22en-US%22%3E%3CP%3EWe%20have%20started%20to%20play%20around%20with%20Azure%20AD%20%2C%20AD%20local%20and%20Azure%20ADS.%20The%20Hybrid%20solution%20is%20currently%20our%20solution%20for%20now%20until%20we%20can%20get%20comfortable%20and%20then%20move%20our%20on%20prem%20VM%20to%20Azure%20VM%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-924536%22%20slang%3D%22en-US%22%3ERe%3A%20What%20are%20the%20Differences%20Between%20Azure%20Active%20Directory%20and%20Azure%20Active%20Directory%20Domain%20Servic%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-924536%22%20slang%3D%22en-US%22%3E%3CP%3EOne%20other%20con%20of%20AADDS%2C%20based%20on%20my%20understanding%2C%20is%20that%20you%20can't%20use%20it%20with%20VM's%20backed%20up%20to%20Azure%20for%20ASR.%20I%20was%20told%20because%20those%20servers%20are%20being%20restored%20%22as%20is%22%20and%20not%20being%20rebuilt%2C%20they%20are%20expecting%20a%20traditional%20AD%20server%20in%20Azure%20to%20authenticate%20against.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-951114%22%20slang%3D%22en-US%22%3ERe%3A%20What%20are%20the%20Differences%20Between%20Azure%20Active%20Directory%20and%20Azure%20Active%20Directory%20Domain%20Servic%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-951114%22%20slang%3D%22en-US%22%3E%3CP%3EYou%20can%20install%20ADFS%20in%20managed%20domain%20using%20the%20following%20guide.%20By%20no%20mean%20this%20supported%20or%20even%20recommended%2C%20but%20it%20was%20doable%20last%20time%20I%20checked.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-953989%22%20slang%3D%22en-US%22%3ERe%3A%20What%20are%20the%20Differences%20Between%20Azure%20Active%20Directory%20and%20Azure%20Active%20Directory%20Domain%20Servic%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-953989%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F433173%22%20target%3D%22_blank%22%3E%40SecureCloudBlog%3C%2FA%3E%26nbsp%3BThis%20is%20absolutely%20%3CU%3E%3CSTRONG%3ENOT%3C%2FSTRONG%3E%20%3C%2FU%3Esupported%20or%20recommended.%26nbsp%3B%20%26nbsp%3Byou%20will%20end%20up%20with%20issues%20with%20write%20access%20to%20the%20managed%20domain.%26nbsp%3B%20Azure%20AD%20DS%20is%20more%20for%20providing%20authentication%20to%20legacy%20application%20workloads%20in%20Azure%20rather%20than%20end-user%20authentication%20like%20this.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Microsoft

I met with some customers last week, and we had a great conversation about Active Directory and the differences between all the flavours available to them when adopting a hybrid posture.

 

More specifically, what are the difference between:

It's essential to understand the differences when you’re looking at a “lift-and-shift” scenario from on-prem to IaaS.  If you are moving to the cloud by subscribing to SaaS applications or rewriting existing applications using modern PaaS services, you’ll want to take advantage of Azure Active Directory (AAD). AAD is our cloud-based identity solution that allows you to leverage users, groups, applications and security principal concepts. It supports web-based OAuth 2.0, SAML 2.0 and Open ID authentication frameworks.

 

However, AAD does not have capabilities like Group Policies or Application Containers or extensible schema, which is sometimes required by some workloads, among other capabilities.

 

 

When "lifting and shifting" applications to the cloud, there are a lot of identity needs that may be required, do they use AD services? Does the workload need a service account managed by AD both on-prem and in IaaS? Does the workload need to Extend the AD schema? Does the application need access to an Application Partition in AD?

 

clipboard_image_0.png

 

You need to know your apps and how they interact with AD.  Once that is known, you can now decide if you will use one of the two remaining options, namely AD or AADDS, you can use to support your workload.

 

Here are some of the differences you need to keep in mind.

 

Feature

AADDS

AD

Managed service

Secure deployments

You secure the deployment

DNS server

 (managed service)

Domain or Enterprise administrator privileges

Domain join

Domain authentication using NTLM and Kerberos

Kerberos constrained delegation

Resource-based

Resource-based & account-based

Custom OU structure

Group Policy

Schema extensions

AD domain/forest trusts

Secure LDAP (LDAPS)

LDAP read

LDAP write

 (within the managed domain)

Geo-distributed deployments

 

Azure Active Directory Domain Services (AADDS)

 

clipboard_image_2.png

 

Azure Active Directory Domain Services (Azure AD DS) provides a managed domain services with a subset of fully compatible traditional AD DS features such as domain join, group policy, LDAP, and Kerberos / NTLM authentication.


It integrates with Azure AD and, when synchronized with an on-premises AD DS environment, allows you to extend your on-prem identities to run in Azure as part of a lift-and-shift strategy.

 

clipboard_image_3.png

 

It all sounds wonderful, and it is in most cases. Here are some pros and cons. (This list is my own opinion)

Pros

The deployment of AADDS is relatively simple once you have your on-prem AD connected to AAD using Ad Connect.  It takes away the need for you to deploy your Domain Controllers in Azure and to ensure that your DCs are in different fault and update domains, and it takes care of the DC patching for you.

 

AADDS provides an experience that is fully compatible with a subset of features of Active Directory (see above). Depending on your apps, they may keep running in the cloud without any modifications.

 

As I mentioned since it's a managed Directory service, it is highly available the DCs and the AADDS will be automatically backed up.

 

You will not need to set up a site-to-site VPN or use ExpressRoute to facilitate the replication of self-managed regular AD domain controllers.

 

Cons

AADDS does support Group Policies. However, there is no GPO replication from on-prem; you must recreate the policies you need in the managed directory service. If you change one on-prem, you must perform the same change in the managed Directory.

 

AD domain/forest trusts are not supported at this point. (it's on the roadmap). 

 

There are no capabilities for Geo-distributed deployments.  Your managed AADDS is limited to the virtual network on which you deployed it. You can go around that problem by setting up VPNs and peered virtual networks, but it adds considerably more complexity to your environments.

 

As you can see in the diagram above,  the replication from your Azure AD tenant to AADDS is a one-way replication.  There are no facilities for LDAP writebacks outside of the managed domain in that virtual network, which means that the changes are NOT written back to the on-prem AD through the AD Connect sync process.

 

Active Directory (AD) in IaaS

 

Deploying Active Directory in IaaS is virtually the same as setting it up in remote offices.  You need a connection (site-to-site VPN or ExpressRoute), DCs deployed in each Virtual networks, defined sites in AD to managed replication and authentication requests.

clipboard_image_4.png

These are tasks that we all know and have been doing for years. It feels familiar.  It's comfortable and that's ok.  This design also has Pros and Cons.

 

Pros

 

As I mentioned, it's familiar and comfortable.  It ensures that if an app worked on-prem it will still work once migrated to azure, the Application Partitions, the extended schema, the group policies will all be there.  Writebacks will occur natively without any duplicate work.

 

you are not limited to a single virtual network.  you can deploy as many sites as required anywhere in the world where Azure regions are found.
 

Cons

It's not a managed Directory Service, therefore you must take care of it.  Each additional domain Controller is another machine you must maintain and patch.

 

You must define where you deploy each DC to ensure availability. You must manage the backup and DR capabilities

 

Virtual Machines are typically more expensive than managed services (depending on how many Dcs you deploy and the size of the VMs)

 

Your environment is significantly more complex due to the VPN/ExpressRoutes added VMs and custom DNS service.

 

Conclusion

There is no right and wrong here.  Your design and directory choices are mandated by the workloads you are migrating.  Can they function adequately with AADDS?  do the absolutely require the full power of AD?

 

These are answers I cannot give you. You must find out for yourself. Do your due diligence before you start migrating. 

 

I hope this helps define where you need to look and how you need to think about AD integration when adopting a hybrid posture in Azure.

 

Cheers!

 

Pierre Roman

 

 

 

8 Comments
Visitor

Thks for this very intresting Article.

Senior Member

Thanks, Pierre for sharing this article.

Occasional Visitor

Nice article. Thank you.

Can ADDS be used for setting up windows services like ADFS which needs Domain administrator privileges as you mentioned ADDS does not have Domain or Enterprise administrator privileges feature?

Microsoft
@Abhishek_j ADDS is Active Directory Domain Services....  so yes, you can use it to setup ADFS.  Azure Active Directory Domain Services or AADDS , no.
 
Regular Visitor

We have started to play around with Azure AD , AD local and Azure ADS. The Hybrid solution is currently our solution for now until we can get comfortable and then move our on prem VM to Azure VM

Senior Member

One other con of AADDS, based on my understanding, is that you can't use it with VM's backed up to Azure for ASR. I was told because those servers are being restored "as is" and not being rebuilt, they are expecting a traditional AD server in Azure to authenticate against.

You can install ADFS in managed domain using the following guide. By no mean this supported or even recommended, but it was doable last time I checked.

Microsoft

@SecureCloudBlog This is absolutely NOT supported or recommended.   you will end up with issues with write access to the managed domain.  Azure AD DS is more for providing authentication to legacy application workloads in Azure rather than end-user authentication like this.