- \n
- Switch to using SaaS versions of the s\/w<\/li>\n
- Rewrite the app<\/li>\n
- Lift and shift: the focus today.<\/li>\n<\/ul>\n
How Organizations Handle AD Requirements Today<\/h2>\n
- \n
- They set up site-site VPN and deploy additional domain controllers in the cloud.<\/li>\n
- They deploy another domain\/forest in the cloud and provision a trust, e.g. ADFS.<\/li>\n<\/ul>\n
Imagine a Simpler Alternative<\/h2>\n
- \n
- Simpler<\/li>\n
- Compatible<\/li>\n
- Available<\/li>\n
- Cost-effective<\/li>\n<\/ul>\n
Introducing Azure AD Domain Services<\/h2>\n
- \n
- You provision a VNet.<\/li>\n
- Then you activate Azure AD Domain Services in Azure AD on that VNet<\/li>\n
- You can manage the domain using RSAT.<\/li>\n
- You can optionally sync your Windows Server AD with Azure AD to share accounts\/groups.<\/li>\n<\/ol>\n
Managed Domains<\/h2>\n
- \n
- Domain controllers are patched automatically.<\/li>\n
- Secure locked down domain, complaint with AD deployment best practices<\/li>\n
- You get 2 DCs, so fault tolerant<\/li>\n
- Automatic health detection and remediation. If a DC fails, a new one is provisioned.<\/li>\n
- Automatic backups for disaster recovery.<\/li>\n
- No need to monitor replication \u2013 done as part of the managed service.<\/li>\n<\/ul>\n
Sync<\/h2>\n
If you deploy sync, e.g. Azure AD Connect, then it flows as follows: Windows Server AD <-> Azure AD <-> Azure AD Domain Services<\/p>\n
Features<\/h2>\n
- \n
- SIDs are reused. This means things like file servers can be lifted and shifted to Azure without re-ACLing your workloads.<\/li>\n
- OUs<\/li>\n
- DNS<\/li>\n<\/ul>\n
Pricing<\/h2>\n
Based on the number of objects in the directory. Micro-pricing.<\/p>\n
Decisions<\/h2>\n
![\"27-09-2017](\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2017\/09\/27-09-2017-16-13-Office-Lens_thumb.jpg\" "\\"27-09-2017")
<\/a><\/p>\nNew Features<\/h2>\n
- \n
- Azure Portal AD Experience is GA<\/li>\n
- ARM virtual network join is GA<\/li>\n<\/ul>\n
Demo<\/h2>\n
He creates an AADS domain. THere are two OUs by default:<\/p>\n
- \n
- AADC Users<\/li>\n
- AADC Computers<\/li>\n<\/ul>\n
Back to the PowerPoint<\/p>\n
Notes<\/h2>\n
- \n
- You cannot deploy AADDS in the classic Azure portal any more.<\/li>\n
- The classic deployment model will be retired \u2013 the ARM deployment is better and more secure.<\/li>\n
- The classic VNet support is ending (for new domains) soon.<\/li>\n
- Existing deployments will continue to be supported<\/li>\n<\/ul>\n
Questions<\/h2>\n
- \n
- Is there GPO sync? No. This is a different domain, so there is no replication of GPO from on prem to AADDS<\/li>\n
- Can you add another DC to this domain? No. There will be (in the future) the ability to add more AADDS \u201cDCs\u201d in other VNets.<\/li>\n
- What happens if a region goes down? The entire domain goes down now \u2013 but when they have additional DC support this will solve the problem<\/li>\n
- Is there support in CSP? No, but it\u2019s being worked on.<\/li>\n<\/ul>\n
Manage Azure IaaS VMs<\/h2>\n
You can join these machines to AADDS. You can push GPO from AADDS. You\u2019ll sign into the VMs using AADDS user accounts\/passwords.<\/p>\n
GPO<\/h2>\n
Members of AADDC Administrators can create OUs. You can target GPO to OUs.<\/p>\n
Move Servers to the Cloud<\/h2>\n
Sync users\/passwords\/SIDs to the cloud, and then lift\/shift applications\/VMs to the cloud. THe SIDs are in sync so you don\u2019t need to change permissions, and there\u2019s a domain already for the VMs to join without creating DC VMs.<\/p>\n
LDAP over SSL<\/h2>\n
I missed most of this. I think you can access applications using LDAP over SSL via the Internet.<\/p>\n
Move Server Applications To Azure<\/h2>\n
User AADDS to provision and manage service accounts.<\/p>\n
Kerberos Constrained Delegation<\/h2>\n
Cannot work with AADDS using old methods –\u00a0 You don\u2019t have the privileges. The solution is to use PowerShell to implement resource-based KCD.<\/p>\n
Modernize Legacy Apps with Application Proxy<\/h2>\n
You can get users to sign in via AAD and MFA into legacy apps. A token is given to the app to authorize the user.<\/p>\n
SharePoint Lift and Shift<\/h2>\n
A new group called AAD DC Service Accounts. Add the SharePoint Profile sync user account to this group.<\/p>\n
Domain Joined HDIsnight Cluster<\/h2>\n
You can \u201cKerber-ize\u201d a HD cluster to increase security. This is in preview at the moment.<\/p>\n
Remote Desktop Deployments<\/h2>\n
Domain-join the farm to AADDS. The licensing server is a problem at the moment \u2013 this will be fixed soon. Until then, it works, but you\u2019ll get licensing warnings.<\/p>\n
Questions<\/h2>\n
- \n
- Schema extensions? Not supported but on the roadmap.<\/li>\n
- Logging? Everything is logged but you have to go through support to get at them at the moment. They want to work on self-service logging.<\/li>\n
- There is no trust option today. They are working on the concept of a resource domain \u2013 maybe before end of the year.<\/li>\n
- Data at rest, in ARM, is encrypted. The keys (1 set per domain) are managed by MS. MS has no admin credentials \u2013 there\u2019s an audited process for them to obtain access for support. The NTLM hashes are encrypted.<\/li>\n<\/ul>\n
Deciding When to DIY Your Own AD Deployment<\/h2>\n
![\"27-09-2017](\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2017\/09\/27-09-2017-16-39-Office-Lens_thumb.jpg\" "\\"27-09-2017")
<\/a><\/p>\n<\/p>\n
Features Being Considered<\/h2>\n
- \n
- Cloud solution provider support \u2013 maybe early 2018.<\/li>\n
- Support for a single managed domain to space multiple virtual networks<\/li>\n
- Manage resource forests<\/li>\n
- Schema extensions \u2013 they\u2019ll start with the common ones, and then add support for custom extensions.<\/li>\n
- Support for LDAP writes – some apps require this<\/li>\n<\/ul>\n
Any questions\/feedback to aaddsfb@microsoft.com<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
Options when Moving to The Cloud Switch to using SaaS versions of the s\/w Rewrite the app Lift and shift: the focus today. How Organizations Handle AD Requirements Today They set up site-site VPN and deploy additional domain controllers in the cloud. They deploy another domain\/forest in the cloud and provision a trust, e.g. … Continue reading “Azure AD Domain Services”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":19530,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"categories":[14],"tags":[169,170,155,211,176,177,203],"class_list":["post-20595","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-eventnotes","tag-active-directory","tag-azure","tag-azure-ad","tag-azure-ad-domain-services","tag-eventnotes","tag-events","tag-ignite"],"aioseo_notices":[],"jetpack_featured_media_url":"https:\/\/aidanfinn.com\/wp-content\/uploads\/2016\/05\/AzureADLogo_52B0BEF61.png","amp_enabled":true,"_links":{"self":[{"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/posts\/20595","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=20595"}],"version-history":[{"count":4,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/posts\/20595\/revisions"}],"predecessor-version":[{"id":20608,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/posts\/20595\/revisions\/20608"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/media\/19530"}],"wp:attachment":[{"href":"https:\/\/aidanfinn.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=20595"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=20595"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=20595"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"27-09-2017](\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2017\/09\/27-09-2017-16-13-Office-Lens.jpg\" "\\"27-09-2017")
<\/a><\/p>\n