hey how you doing i'm just reading through some comments and uh a lot of people asking
about their on-prem domains and how to extend that into azure using things like hybrid domains and
azure ad domain services so i think we need to get one thing straight
i'm Dean Cefola and this is the azure academy so the first thing we need to do is take these three
separate things and we need to give a basic understanding of what they are and how they
work now you've been using active directory for neuron forever at this point but your key value
propositions out of active directory is ntlm and kerberos authentication group policy management
ldap dns resolution all that good stuff even though we call it azure active directory it's not
an active directory in the same sense as ad is meaning that it's not a directory structure
there's no hierarchy there's no ous that stuff just isn't there today it's also not based on ntlm
and kerberos auth this uses oauth and saml there's no gpos and it's really there as an identity
service so in that sense they are the same thing because ad was our identity service on-prem azure
ad is the identity provider in the cloud let's get to the hero of today's video azure ad domain
services now i have found that this service is extremely misunderstood in what it is how it does
and how it works with ad and azure ad so what is azure ad domain services well it is a traditional
type domain controller but done as a cloud pass service the beauty of that unlike your regular
domain controllers you don't have to manage it it pretty much just takes care of itself and provides
for you ntlm kerberos ldap dns and this is where the problem comes in because most people when they
think about extending their active directory into the cloud they're thinking about it traditionally
taking a domain controller that they have on-prem that's got their domain they have 80 sites and
services and we're going to put up another one in the cloud in a different azure ad site
called azure it's going to have its own ip address range and that's how you traditionally extend ad
into azure azure ad domain services is nothing like that whatsoever azure ad domain services is a
completely separate independent microsoft managed forest and domain it is not connected to your
active directory in any way shape or form it is not an extension of a.d it is not a different site
in your ad forest and what this means is that it is not an extension of your domain at all let
me put it this way it's kind of like if i have a domain called ms azure academy let's say that you
also created in your own lab ms azureacademy.com as a domain now can you technically do this yes
you can there's nothing stopping you it's your lab it's your domain controller but when you put
those things on the internet now you're going to have a problem because all of the records globally
resolve to me but let's skip past that for a second and just think about it as my domain
and your domain and they're called the same thing i cannot manage your domain you can't manage my
domain that's what azure ad domain services is it's a completely independent microsoft managed
domain that may or may not have the same name as your own domain but it's not yours to control
you are not an enterprise admin you are not a domain admin and you are most certainly not a
schema admin you have a little more rights than just the standard user but not much so with all
these downsides why in the world would you want to use this thing well there are some
very clear use cases first would be if you don't have an on-prem active directory but you still
need ntlm and kerberos this is a great use case for that because you don't have to manage it all
you have to do is click the button and deploy it and then reap the benefits it's also one of the
ways you can implement windows virtual desktop it integrates very nicely with ad authentication
to an azure file share and like i mentioned before it integrates very nicely with azure ad
it's simply there so that you can do all of your legacy authentication in a modern authentication
world speaking of authentication let's talk about our users you already know that you have
active directory and you have a domain controller which stay in sync using this lovely tool azure ad
connect that's how your identities end up in the cloud and they have the same password that they
have on prem so let's turn this whole thing for just a moment and we're going to now look at the
azure ad domain services side of this equation so we have now our users let's say batman sitting up
here in azure when we build azure ad domain services there is a managed azure ad connect
sync that happens between azure and azure ad domain services so batman will sink over into
the azure add ds domain and therein lies the problem because when batman ends up there you
will never be able to log in why because when azure ad connect does its magic and syncs our
password hashes into azure they're not stored in a format that is ntlm kerberos compatible so sorry
batman but you don't have a password and this same thing happens to your administrators in your azure
add ds domain in order to log in you have to force a password reset which you can just do on
demand or set an expiration for your password so that people have to go in and change them
when the passwords are reset now we will have a hash that we can sync over to azure ad domain
services and now you can log in if you want to master the azure cloud you can start right
now by clicking the subscribe button and the notification bell so you don't miss anything
so let's set up azure ad domain services here we are in my azure active directory you can see that
i've got azure ad connect already syncing and i am a global administrator so i'll start by going
to the global search up there at the very top and we'll type in domain services and we'll click on
azure ad domain services and once we get to this blade we'll just click to add a new instance of
azure id domain services and first thing of course we need is a subscription and resource group
and now we have our domain name now you can leave it as your exact domain name matching
what you already have on pram and in azure ad but just to keep it simple i'm gonna make my domain
aadds.msureacademy.com no matter what we call it there's still two completely separate independent
forests so the next thing of course is our region and you want something as close to the
rest of your stuff as possible and then we have our sku you can click on the link way over there
to find out more about each sku and what they offer to sum it up from a technical standpoint
standard is just normal azure ad domain services whereas premium and enterprise will give you the
option for adding a resource domain which is the next button below it and we hit next and this is
where we set up our network at the very top it of course suggests a new network for this and you can
do that if you want to but i want to show you some other options if you have an existing network or
subnet that you want this to use and i've got two of them here one labeled bad and one good
if i click on the bad one you see that we've got red all over the place because it's not in
a ip address range that azure ad domain services requires and then if we go back and select good
because it isn't a good range we are good to go so we'll hit next next we have the administration tab
and here's where we're going to set up a new group in azure ad that is called aadc administrators
so that's our admin group for azure id domain services even though you're not like a domain
admin like i mentioned earlier and if you click on the link here to manage your group membership
and then at the top here you can select the add members and then up here you can select just like
a standard user picker whatever group or user membership you want to add then the next section
here is for notifications i suggest leaving those alone but you can do whatever you like here
now we're on the synchronization tab by default it's going to sync everything that is every user
and group in your azure active directory if you want something different you can just change the
tab here to scoped and then right under that you have a synchronization scope just click to select
which groups you want to add i'm okay with syncing all of my users and groups so i'll just change
that back to all and we'll click next and then azure's going to go ahead and validate everything
that we have just selected and then your create button will be highlighted when you click on it
now we're going to get this little pop-up because there's a few things you need to know
and this is just telling you that you better be really sure that these settings are all okay
because none of these items are going to be able to be changed once you spin this up of course you
could always delete it and reprovision if you needed to but we'll click ok to that and then
like any other resource it is going to provision so when it's all done you'll see this screen
where azure ad is now reporting healthy but we're not done yet there's a couple other things we have
to set up so we have to now configure our dns settings just like a standard domain controller
so if you scroll down just a little bit you'll see a configure dns button and if you click that
it'll take care of doing all that for you the way it does it is by taking the virtual
network where your azure ad domain services vms are set up and just configures that to use custom
dns pointing directly at our two new domain controllers that are part of our service
now we have to get our users configured so just below that you can see a link that we'll
right click on and open in a new tab and this is how we can get our password hashes in azure ad
to go over into azure id domain services and we're going to use our azure ad connect in order to
make this happen so if you scroll down here to the enable synchronization for password hashes section
click the copy button and now we'll pop over to the server where i have azure ad connect
installed and we'll open up powershell copy in your code and open azure ad connect so at the top
we'll go to the connectors tab and then you want to select on the first connector and that will
have a type of windows azure active directory and then we want to copy the name exactly
because we'll need that for powershell at the very top we've got a variable and then we'll plop
that right into the first variable go back into azure ad connect take our second connector which
should be the type of active directory domain services doing an exact copy of the name again
back to powershell and paste it as our second variable and then what i like to do is to run that
section just at the top with the import module commands just so i get that stuff out of the way
followed briefly by selecting the rest of the code and then running that as a separate command now
we'll pop over back into azure active directory and go to our groups because we have a new group
the azure ad dc administrators and if we go there and go to our members there's the people that we
assigned now let me go to superman and do a password reset but oh we've got a problem we
cannot do a password reset because in order to do that we need to have password right back enabled
so back to our domain controller and we'll open up the azure ad connect tool so we can configure it
once it's open click configure and then we want to click on the customize synchronization options
and then hit next put in the appropriate username and password click next and on the connect your
directories screen we'll just click next there as well as a domain and ou filtering and here in the
optional features is where you'll find that little checkbox for password right back now what is that
going to do we've already set up the password hash synchronization with our powershell from
azure into azure ad domain services this is going to go the other way now we've got password changes
that'll happen in the cloud in azure and that will be synchronized back to our domain controllers
whether on-prem or in the cloud so we'll click next and on the single sign-on screen you could
already have that enabled or not doesn't matter just click next and then you can go ahead and
click configure to finish everything out and when you're done just hit the exit button now we're
back in azure we can finally click on that reset password button and azure will now let us do that
so i'll put in a temporary password of change me and then we will go to a private browsing window
and log in with superman will provide change me as my current password as well as a new password and
we are logged in so now that our users are done let's take a look around azure ad domain services
and see what we've got so i've got two different azure ad users and computers open over on the left
is azure av domain services and on the right is my traditional domain controller so right away you
can see that the ou structure is not the same at all and you may be thinking of course they're not
the same the domain names are different but like i told you before it doesn't matter whether it
is exactly the same name as your current domain environment or a completely different name or
even one that appears like a subdomain name like mine does they are completely separate independent
forests and looking over at the domain controllers container you see of course that we have
two different sets of domain controllers and you can see that the sites are different as well
more about that in a second but let me right click on an ou on both sides and you can see on
the right side where i am a domain admin i've got the ability to create anything new that i want to
but even though i'm logged on on the left with superman who is my azure add dc admin i don't
have the rights to create anything if you looked at active directory sites and services again on
the right we have my traditional domain and over there on the left azure ad domain services and
they are very different once again and notice that the site from either one of them does not appear
in the scope of the other they are completely disconnected separate independent no way are
they ever going to talk to each other environments and this is not an extension of my existing domain
into azure and just to prove the point once and for all i have rebuilt my azure ad domain services
environment and it is now named exactly like my regular domain ms azureacademy.com and as you can
see it is still a completely separate independent domain and forest that is not communicating at all
with my on-prem a.d it is only the user accounts that can be synced from one environment into the
other the two domains do not communicate at all so i hope that this has cleared up for you the
purpose of azure ad domain services and how it can benefit you as you're building out something
like windows virtual desktop or integrating with azure files or any other azure ad application that
requires ntlm and kerberos and keep an eye out for some future videos on hybrid join as well as
azure ad join in getting us prepared for windows virtual desktop being able to use those features
so make sure that you click subscribe like comment share all the buttons that are doing all the good
stuff and you want to check out our latest video right over there so that you can be sure to stay
on top of everything going on in azure as well as this one right down here that the youtube
machine overlords have picked out just for you and we will catch you next time happy learning