Domain join not working via custom extension via Terraform

Copper Contributor

Getting error when trying to domain join an Azure VM via terraform code with a custom VM extension script:

resource "azurerm_virtual_machine_extension" "domain_join" {
  name                       = "${var.prefix}-domainJoin"
  virtual_machine_id         =
  publisher                  = "Microsoft.Compute"
  type                       = "JsonADDomainExtension"
  type_handler_version       = "1.3"
  auto_upgrade_minor_version = true

  settings = <<SETTINGS
      "Name": "",
      "OUPath": "",
      "User": "test.onmicrosoft\\adminuser",
      "Restart": "true",
      "Options": "3"

  protected_settings = <<PROTECTED_SETTINGS
      "Password": "${var.domain_password}"

  lifecycle {
    ignore_changes = [settings, protected_settings]

Error code for domain join for Azure VM is failing via terraform code:

Error: Code="VMExtensionProvisioningError" Message="VM has reported a failure when processing extension 'vm-domainJoin' (publisher 'Microsoft.Compute' and type 'JsonADDomainExtension'). Error message: \"Exception(s) occurred while joining Domain ''\". More information on troubleshooting is available at "

│ with azurerm_virtual_machine_extension.domain_join,
│ on line 68, in resource "azurerm_virtual_machine_extension" "domain_join":
│ 68: resource "azurerm_virtual_machine_extension" "domain_join" {


+ It always fails with below error:
+ All Infra is on Azure only.
+ Let's say Domain controller IP is, AD DS is "" synced successfully.
+ VM in same VNET is also not able to do the domain join.
+ Domain in Controller is configured as
+ DNS is configured as well.
+ Via Terraform code, VMs are configured successfully with all attributes but domain join extension provisioning fails. I can see the extension in GUI under the VM extensions though.
+ Manual domain join works.
+ VM has correct DNS servers i.e., as per ADDS sync message. added which is configured on Az DC VM

Any suggestions what to check to fix this issue and let any new VM join the domain?


+ Code seems ok.
+ Verified the attributes in DC.
+ Manual domain join works.

+ Code seems ok.

+ Verified the attributes in DC.
+ Manual domain join works.

Any suggestions to get it fixed? 

2 Replies



What is the role assignement for this script?

Virtual Machine User Login