Augmenting Azure AD with GPO

[B4K4Fire]

Hello,

This is my scenario. I am looking to eliminate my physical AD server. I have a Windows Server 2019 VM in Azure with the GP Management tools. This VM is joined to an Azure Managed Domain. I have computers that are Azure AD joined. I want to apply group policies from that Windows Server VM to my Windows 10 Azure AD Joined laptops. Please help

[#2]

Hi @B4K4Fire ,

It is important to distinguish several things here:

• as I understand, you have an on-premises Active Directory with domain controllers. I would assume you integrated it with your Azure AD by using AAD Connect and synchronized your on-prem accounts and groups to AAD
• you wrote that your Azure VM is joined to 'Azure Managed Domain'. Since this is a Windows Server, it indicates you are referring to Azure AD Domain Services. I assume you enabled this service in a specific VNet and it synchronizes users and groups from your Azure AD domain to this managed directory.
  • As a side note, this domain has no trust relationship with your on-premises AD domain (even though you see the same users and groups in both ADs, they have different SIDs, GUIDs, etc.).
  • In other words, even the GPOs in your on-prem AD are different from those in AAD DS (the technology is the same, but when you enable AAD DS, there are no GPOs added by default, and there is no synchronization mechanism that would allow you to sync it from your on-prem AD).
• You can use that Azure VM to manage that AAD DS instance (domain-join VMs, create GPOs, OUs, etc.).
  • You probably know that you don't have full Domain Admin rights, since the domain is managed by Microsoft (and there are other limitations)
• You are trying to apply Group Policies to a Windows 10 machine that was 'Azure AD Joined'. Since your W10 machine is 'AAD Joined' (not Hybrid-AD Joined), you cannot apply Group Policies to it. Azure AD does not use GPOs, it is a cloud directory, built for scale with API-first approach. You can use Intune or other MDM tool to manage your W10 AAD-joined machines, but not AD GPOs.
• You could in theory join your W10 machine to that AAD DS managed domain and configure GPOs there (using your admin Windows Server machine), but this makes little sense to me.

To summarize:

• you should use Azure AD Domain Services (managed domain) for Azure-hosted VMs (could be server or client OS, e.g. Windows Virtual Desktop), but not on-premises hosted machines
• you should consider using modern management solutions to manage your physical W10 PCs (moving from GPOs to MDM policies). Eventually, you could use Hybrid AD join and continue using GPOs for Windows 10 clients (but not with AAD DS)