May 01 2019
- last edited on
Jul 24 2020
In Azure AD Domain Service i see default have some ou
in ADDC Users , i can create new user in here ? and can delete user in here ? if delete or create user in here then it can sync to Active Directory on-premier ?
May 04 2019 12:27 PM
If you do not have any admin permssions as domain admin or enterprise admin you should not be allowed to create or remove users from there. The easiest way to do it is to create it through Azure AD and after that once the user is created it will sync up to 20 minutes@Tien Ngo Thanh
May 05 2019 05:42 AMSolution
Hello @Tien Ngo Thanh !
When you create AAD DS and you are member of "AAD DC Admins" it has limited permissions to managed domain (no domain or enterprise admin permissions). Pretty good list what can be done is found behind this link.
Last time I had a possibility to play with AAD Domain Services default permissions for those default OU's were defined so that admin were not able to create users for the OU's. Those were:
Another questions was about the synchronization, it's one-way sync from on-premises to AAD Domain Services. If you create user account to own OU it will not be synced back to on-premises.
Note for managing custom OU's from docs.microsoft.com:
With a custom OU, you can go ahead and create users, groups, computers, and service accounts in this OU. You cannot move users or groups from the 'AADDC Users' OU to custom OUs.
User accounts, groups, service accounts, and computer objects that you create under custom OUs are not available in your Azure AD tenant. In other words, these objects do not show up using the Azure AD Graph API or in the Azure AD UI. These objects are only available in your Azure AD Domain Services managed domain.