Questions[azure-active-directory-ds](server)

I've created an Azure VM and joined it to the Azure AD domain. I've enabled Azure AD login on the VM, and added users to the Azure AD AAD DC Administrators group, which is assigned the Administrator role in the VM.

I can RDP to the VM as a user in the AAD DC Administrators group that is a member of the Azure AD domain. However, I cannot RDP to the VM as a user in the group that is a guest user in the Azure AD domain. When I attempt to do so, the RDP client indicates that the credentials are incorrect for the guest user:

The credentials that were used to connect to did not work. Please enter new credentials.

I've verified that the credentials that I'm supplying are correct. I'm trying to determine if it's because:

1. the format of the credentials that I'm supplying is incorrect (e.g,. should I use Domain\user.name, or [email protected], or Domain\[email protected]);
2. it's a password hah sync problem (this is a cloud-only account); or,
3. it's not possible to do this.

I have a multicloud setup using Azure VM's and Google Cloud VM's that are connected via a site-to-site VPN (from Azure). VPN connectivity is all working fine, however I'm now trying to join all (both Azure and Google) VM's to the same domain hosted in Azure (AADDS). Azure VM's are joined successfully after peering the Vnets and adjusting the DNS servers to point to the AADDS interal IP's, but I'm stuck at the google VM's.

I have:

• verified the VPN connectivity from google VM's to the AADDS internal ip's, I get a successfull ping reply on both ip's.
• used DIG to see the DNS config that the Azure VM's are using and tried to copy those to a Google DNS Zone (private).
• verified that I can ping the domain(name) from my google VM.

I feel this is a DNS issue, considering the ping is working fine. Initially I got the SVR-record missing error so I added a specific SVR record _ldap._tcp.dc._msdcs svr and also tried the wildcard SVR. But I end up with the following error when trying to join:

Note: This information is intended for a network administrator.  If you are not your network's administrator, notify the administrator that you received this information, which has been recorded in the file C:\Windows\debug\dcdiag.txt.

DNS was successfully queried for the service location (SRV) resource record used to locate a domain controller for domain "mydomain.com":

The query was for the SRV record for _ldap._tcp.dc._msdcs.mydomain.com

The following domain controllers were identified by the query:
mydomain.com


However no domain controllers could be contacted.

Common causes of this error include:

- Host (A) or (AAAA) records that map the names of the domain controllers to their IP addresses are missing or contain incorrect addresses.

- Domain controllers registered in DNS are not connected to the network or are not running.

We are a school and have a Novell/NetIQ directory service for our local computers. Multiple services (such as Moodle) are connected over Open LDAP/LDAPS (Port 636) for user authentication. We would also like to have the same usernames/passwords for Office 365. Till now, we import the usernames from a csv-file at the beginning of every school year and generate passwords directly in Office 365, but it's confusing for our users to have different passwords for different services and it would be nice to have everywhere the same username and password.

Is there a way to synchronize the data from Novell/NetIQ (master) to Azure Active Directory? Ideally over LDAPS, because our server has already an outside connection for Moodle and other services. For historical reasons, we can not migrate to Microsoft's Active Directory.

What I've tried: Installed Microsoft Azure AD Sync on a Windows Server and tried to add a LDAP-connection referring to this source. Connection failed, "The LDAP-Server is not available."

Terminology

Given the very similar terminology, let me set out the two things I am asking about...

Firstly, Azure Active Directory. This is the directory service that underpins o365. You can sync credentials into it and use it for SSO via SAML and a few other bits, but that is basically it.

Secondly, Azure Active Directory Domain Services. This is much closer to a ADDS as we know it since Windows 2000 (OUs, Group Policy, NTLM, etc.) but provided as-a-service. There are a bunch of limitations (no domain admin rights, no schema extensions, no direct access to DCs) but you can domain-join servers to it in the traditional manner.

Their names being so similar has made for very frustrating Google results when trying to get any information about how they might interact, hence my question here!

My Goal

My goal is to move as much as is possible to the Cloud. I already have Exchange and SharePoint moved via o365 and have my on-premise AD syncing with Azure AD. I want to move all my servers to Azure too and use Azure AD Domain Services rather than build my own DCs as Azure VMs. All of that seems achievable.

My critical requirement: I want a user that logs into their o365 mailbox to do so with the same credentials as they use to login to a server (or service running on a server) that is domain-joined to the Azure AD Domain Services domain.

My Question

How do I achieve that critical requirement?!

Do I 'extend' or 'Upgrade?' my Azure AD instance to an Azure AD DS instance? There doesn't seem to be any option to do so.

Do I somehow sync my Azure AD and Azure AD DS instance? Does this mean building a VM to run the AD Connect tool?

There seems to be almost nothing written on the topic (that I can find!) and so your insights are greatly appreciated!

We currently have an Active Directory setup which was synced to our Azure AD. We are trying to migrate that to use Azure AD Directory Services which provide the domain controllers in the cloud.

I did not want to take the old domain controllers down while making the transition so I decided to go with a new domain name. The domain has changed from internal.company.com to ad.company.com.

When switching a computer from the old domain to the new one, the new user will get a new user folder on the PC. For example, a user with UPN john.doe now has a user folder called john.doe.ad when logging in with the new domain.

Would it be possible to keep the old user folder when moving to a new domain?

Also willing to accept suggestions on the best way to make this migration happen if anyone has any.

Thanks