Microsoft Entra Domain Services (Azure AD DS) | Microsoft Azure (2024)

|

• Domain Services is a part ofMicrosoft Entra, the new product family for multicloud identity and access solutions.

• No. You can create a single managed domain serviced byMicrosoft Entra Domain Services for a singleMicrosoft Entra tenant.

• Yes. Domain Services can be enabled in an Azure Resource Manager virtual network. Classic Azure virtual networks are no longer available when you create a managed domain.

• No. Guest users invited to yourMicrosoft Entra tenant using theMicrosoft EntraB2Binvite process are synchronized to your Domain Services managed domain. However, as passwords for these users aren't stored in your Microsoft Entra tenant,Domain Services has no way to synchronize NTLM and Kerberos hashes for these users to your managed domain, so they can't sign in or join computers to the managed domain.

• Yes. Each Domain Services managed domain includes two domain controllers. You don't manage or connect to these domain controllers—they're part of the managed service. If you deploy Domain Services into a region that supports availability zones, the domain controllers are distributed across zones. In regions that don't support availability zones, the domain controllers are distributed across availability sets. Learn more aboutavailability options for virtual machines in Azure.

• Changes made in yourMicrosoft Entra tenant using either theMicrosoft Entra admin center or PowerShell are automatically synchronized to your managed domain. This synchronization process runs in the background. There's no defined time period for this synchronization to complete all the object changes.

• No. Once you've enabled a Domain Services managed domain, the service is available within your selected virtual network until you delete the managed domain. There's no way to pause the service. Billing continues on an hourly basis until you delete the managed domain.