How to Deploy Domain controller on Azure

This articles focuses on deploying a domain controller on Azure.

Requirements

• An Azure AD tenant with an active subscription.
• A Virtual Network in Azure that doesn’t overlap with your on-premises network.
• A continuous line of sight between your on-premises domain controller and Microsoft Azure (Azure VPN Gateway, ExpressRoute or an NVA).

Test Your On-Premises Domain Controller

Before deploying an extra domain controller it’s good to test the health of the current DC. Existing problems must be fixed before continuing.

• Analyse your Active Directory and DNS Logs.
• Test your domain controller health with dcdiag /s:dcName
• Test DNS with dcdiag /s:dcName /test:dns

Deploy A Virtual Machine

1. Navigate to https://portal.azure.com and sign-in with a user that has sufficient permissions.
2. Create a new Windows Server resource. I Recommended using Windows Server 2019.
3. Enter al basic information and don’t forget about the availability options. Don’t use a spot VM to save costs – a domain controller should be always online.

Remember, when deploying domain controller in Azure make sure to separate each domain controller in different availability zone or in same availability set.

By default, allow selected ports is enabled to alow RDP (3389). For safety reasons, you should set this option to none. If required, a network security group can be attached to the subnet or vm afterwards to block certain ports. I Recommend attaching NSG’s to subnets.

4. Click Next to configure vm disks.

A Single VM without premium SSD’s has an SLA of 99.95%. A Single VM with premium SSD’s (all disks) has an SLA of 99.99%. I Recommend using premium disks for your domain controller.

Add a second (premium ssd) disk with host caching set to none. This disk will contain the database, logs and sysvol folders. A Disk with a size of 8GB is sufficient.

5. Click Next to configure networking. Attach the VM to your existing vNet that’s connected with your on-premises domain. Don’t assign a public IP address to your virtual machine as recommended by Microsoft – use a VPN or Azure Bastion to connect to the machine. Again, I’ll apply NSG’s to my subnet if required.

6. Finish all steps to create the virtual machine. Don’t enable ‘Login with AAD credentials‘ or ‘Auto-shutdown’.

Configure IP Settings

The virtual machine must have a static IP address and the primary DNS server must point to the on-premises domain controller.

Static IP Address

1. Click on the network interface of your new virtual machine.

2. Select IP configurations and click on the IP config to change the IP settings.

3. Select Static and configure the IP address. Don’t forget to click save – a reboot may be required. You should never configure the static IP address on the VM itself as you do on-premises.

4. Test if you can ping the VM from your on-premises domain controller and the other way around. If this isn’t working you can try the Network Watcher for troubleshooting.

DNS Servers

DNS servers can be configured on the virtual network or on the virtual machine itself. If configured on the vNet, everything that’s connected to this network will inherit these settings (you probably want this).

1. Click on your virtual network to edit it’s settings.
2. Select DNS and confire a custom DNS server (your on-premises domain controller).
3. Don’t forget to click save and reboot the virtual machine.

After adding AD DC roles to the new VM we’ll come back to this page to change the DNS settings once more.

Active Directory Sites & Services

It’s important to create a new site with a corresponding subnet that whill contain your new domain controller. Clients will try to contact the domain controller in their subnet first so a misconfiguration can cause slow logons or other problems. If your on-premises subnet isn’t visible here you should create this one too!

1. Open Active Directory Sites & Services on your on-premises domain controller.
2. Right click Sites and select New Site.

3. Name your new site and link it to the DEFAULTIPSITELINK. Click OK to complete.

4. Right click Subnets and select New Subnet.
5. Enter to correct prefix (your azure subnet that contains your virtual machine) and link it to the new site.

6. Click OK to complete. You should end up with two (or more) subnets and two (or more) sites.

Install Active Directory Domain Services

1. Start Add Roles and Features on the Azure VM.
2. Add the Active Directory Domain Services role and all necessary features.
3. Promote this server to a domain controller.
4. Select Add a domain controller to an existing domain.

5. Enter your domain name and click Select. Provide credentials with sufficient permissions. If you get an error that the wizard can’t find your domain, your DNS settings are probably incorrect.
6. Select the correct site name and enter a DSRM password.

7. Replicate from any domain controller.
8. Change all paths to the 8GB partition (without caching).

9. Leave all other options default or configure as required.
10. Reboot the virtual machine.

Validate DNS Settings

DC on Azure

When the virtual machine is back online, it probably has static DNS servers configured – this happened because of the AD DC roles. Change this back to Obtain DNS server address automatically. Do this for both IPv4 and IPv6. you probably loose connection to the virtual machine.

DC on-premises

The preferred DNS server of your on-premises domain controller should be the domain controller on Azure. The alternate DNS server should point to itself. All other on-premises servers or clients should have the on-premises dc as preferred DNS server.

Virtual Network DNS Settings

The first DNS server should be the DC on Azure and the second DNS server should be the DC on-premises.

DNS Settings DC on Azure

The first DNS server should be the on-premises DC and the second DNS server should be the DC on Azure. Reboot your VM after changing this.

Validate this change on the VM itself by using ipconfig /all.

Azure AD Connect Don’t forget to deploy a second pass-through authentication if you are using this. When using hash synchronization think about migrating your Azure AD Connect to the VM on Azure because it probably will have a greater uptime/SLA than your on-premises environment.

Enforce a naming policy on Office 365 groups in Azure Active Directory

The naming policy is applied to creating or editing groups created across workloads (for example, Outlook, Microsoft Teams, SharePoint, Exchange, or Planner). When group naming policy is configured, the policy will be applied to new Office 365 groups created by end users

Note: Naming policy does not apply to certain directory roles, such as Global Administrator or User Administrator

Custom blocked words

A blocked word list is a comma-separated list of phrases to be blocked in group names and aliases. No sub-string searches are performed. An exact match between the group name and one or more of the custom blocked words is required to trigger a failure.

Blocked word list rules:

• Blocked words are not case sensitive.
• When a user enters a blocked word as part of a group name, they see an error message with the blocked word.
• There are no character restrictions on blocked words.
• There is an upper limit of 5000 phrases that can be configured in the blocked words list.

Roles and permissions required:

To configure naming policy, one of the following roles is required:

• Global administrator
• Group administrator
• User administrator

 

Note: Selected administrators can be exempted from these policies, across all group workloads and endpoints, so that they can create groups using blocked words and with their own naming conventions

Configure naming policy in Azure portal

 

1. Sign in to the Azure AD admin centerwith a Global/Group administrator account.
2. Select Groups, then select Naming policyto open the Naming policy page.
3. On the Naming policypage, select Blocked words.
4. View or edit the current list of custom blocked words by selecting Download.
5. Upload the new list of custom blocked words by selecting the file icon.
6. Save your changes for the new policy to go into effect by selecting Save.