Good day, Cloud Gurus,
and welcome back for this lesson
where we're going to take a look
at performing a domain join on Azure.
Let's take a look at what we're going to cover.
First up, we'll go over each of the domain join options
available to you,
and then we'll dive into each of the options in more detail,
starting with Azure AD join,
and then we'll look at Azure AD Domain Services domain join.
Let's get started.
Now, there are no less than 3 options available to you
for joining your Azure virtual machines
to an Active Directory domain.
Firstly, you can use traditional Active Directory
Domain Services join, which works the same way
as we demonstrated back in Section 3,
and this join can be done
to an Active Directory Domain Services domain
that only exists in Azure on Azure VMs,
or as part of a hybrid deployment
where domain controllers exist both on-premises
and in Azure VMs in the cloud,
and this gives you the same secure logon
that you get on-premises,
and it provides the same configuration
and security management that you're used to.
Alternatively, you can join your Azure VMs
to Azure AD Domain Services.
And this works in a similar way,
but you have a couple of additional options
for performing the Domain Join,
which we'll look at later in this lesson.
You get the same secure logon
using Active Directory Domain Services credentials,
and if you deploy a user forest
those can be synchronized credentials.
And it provides similar configuration
and security management that you're used to
with Active Directory Domain Services,
but there are some subtle differences
and we'll explore those in the next section.
And if you perform a Domain Join
to Azure Active Directory Domain Services,
it allows you to manage the Azure AD
Domain Services managed domain.
And the final option
is to ditch Active Directory Domain Services altogether
and perform an Azure AD domain join
without any domain controllers.
And this supports secure logon using Azure AD
including new Azure AD features,
like multifactor authentication and conditional access.
And it also supports logon using identities
that are synced from Active Directory Domain Services
if you are using Azure AD Connect.
And it also supports granting access to log on to VMs
using Azure role-based access control.
And that's a lot, right? There's almost too many options.
Well, there's actually one more thing.
We mentioned that device objects can be synchronized
from on-premises Active Directory Domain Services
to Azure AD using Azure AD Connect.
When this is configured for hybrid Azure AD join,
you get the benefits
of both Active Directory Domain Services
and Azure AD join at the same time.
But it's important to remember
that hybrid Azure AD join is not supported
with Azure AD Domain Services,
but hybrid Azure AD join is not something we need to know
for the AZ-800 exam.
I just wanted to tie that off.
Now let's take a look
at performing a Domain Join to Azure AD
and Azure AD Domain Services in more detail.
First, let's take a look at performing an Azure AD join.
Before you can perform an Azure AD join,
you need to make sure that you have a VM
that is running Windows Server 2019
datacenter edition or later,
and you'll need Azure role based access control
contributor access to the VM.
And this can be granted
through the Virtual Machine Contributor role
or the Generic Contributor role
and the virtual machine also needs
a system-assigned managed identity.
And for now this is just a checkbox for us in the portal,
but we'll take a closer look at managed identities
later on in the course.
To perform an Azure AD join,
you first need to configure the Azure AD join
either when creating the VM in the portal
or after the VM is created using the extension.
And when you're deploying the extension via the portal,
the name has the extension Azure AD-based Windows logon.
And when you're using command-line tools and ARM templates,
the extension is called AADLoginForWindows.
And then you grant login permissions to the VM,
and it's important to note here
that the Contributor or Owner roles do not grant access
to log on to the VM operating system.
You need to have
the Virtual Machine Administrator Login role,
which grants administrator access
to the virtual machine operating system.
Or the Virtual Machine User Login role,
which grants use access to the VM
with no administrator privileges.
And when logging in, it's recommended you use
the Azure AD UPN format for your username,
and then once you've granted permissions,
you can optionally configure conditional access.
And while this is optional, if you have Azure AD Premium,
it's highly recommended and it's one of the great advantages
of performing an Azure AD join.
And you configure conditional access
using the Azure Windows VM sign-in application in Azure AD.
All right, let's take a look at a demo of this.
We have a VM named VM1,
and we're going to use Azure AD join for this VM
using the extension
and we'll grant access for one of our users to log in
and then we'll test logging in.
All right, we're going to go ahead
and perform an Azure AD Domain Join
for this virtual machine, Virtual Machine 1.
The first step in this process
is to give the virtual machine
a system-assigned managed identity.
So under Settings, we're going to navigate to Identity.
And then we're going to turn on
the system-assigned managed identity,
and then we'll hit Save,
and it's just providing us some details
about the system-assigned managed entity.
We're going to go ahead and select Yes.
All right, the system-assigned managed identity
has now been configured
and now we can perform an Azure AD Domain Join for this VM
using the Azure AD-based Windows login
virtual machine extension.
To do that, we'll navigate to Extensions
and Applications under Settings.
And then we'll select Add, under Extensions.
And then we'll search for the name,
Azure AD-based Windows Login.
We can select that from the dropdown,
then we can select the extension
and then we can select Next,
and then we can go ahead and select Review and Create,
and then after validation we can go ahead and select Create.
All right, this will just take a moment to complete
and Azure will go ahead and perform an Azure AD join
for this virtual machine.
So we'll come back when this is done.
All right, the deployment is now complete.
Now we're going to need to grant
some Azure role-based access control permissions
for our test user Adam Bevan
so that he can access the virtual machine and logon.
So to do that,
we're going to navigate back to the resource group
for this virtual machine
and then we're going to navigate to Access Control IAM.
And then we're going to navigate to Role Assignments.
Now, firstly, we're going to grant Adam Bevan reader access
to this resource group,
and that will allow him to see the virtual machines
that are in the resource group
and collect information about the virtual machine,
like its IP address,
and he will need that information
to connect the virtual machine.
So we'll go ahead and select Add
and we'll select Role Assignment,
and we're going to select Reader and then we'll select Next.
And we're going to add a user
and we're going to select Adam Bevan
and then we'll go ahead and click Select.
And then we can go ahead and click Review and Assign
and then Review and Assign again.
All right, and now we also want to grant Adam access
to log on to the virtual machine operating system.
And to do that,
we're going to grant the Virtual Machine Administrator Login
Azure role-based access control role.
So let's go ahead and click Add again.
We'll select Role Assignment
and then we're just going to search for the name here.
We'll search for Virtual Machine Administrator Login.
Then we can go ahead and select that role
and then we'll go ahead and click Next.
And we'll go to add a user again and we'll select Adam.
And we'll go ahead and click Select
and then Review and Assign
and then Review and Assign once more.
All right, now let's test logging into this virtual machine
using Adam Bevan's user account.
Now you need to use a Windows 10 or later Azure AD joined
or hybrid joined PC to log in using Azure AD.
So let's jump over to an Azure AD joined Windows 10 PC
and then we'll try and log in with Adam.
All right, now let's first type in the IP address for VM1,
which is 10.1.11.11.
And then we'll go ahead and hit Connect.
And then we'll provide the Azure AD credentials
for Adam Bevan.
And you can see we're using the Azure AD prefix
for the username here.
And then we'll go ahead and type in the password
and then we'll go ahead and click OK.
All right, and we're successfully logging on as Adam here.
Once we're logged in, we're just going to run one command
to verify the Azure AD join status.
All right, we're logged in.
So we'll just launch Administrator PowerShell
and this proves that Adam has administrator access
to this virtual machine.
And then we're going to go ahead and run dsregcmd /status
to verify the Azure AD join status.
We'll just scroll back up to the top and we can see here
that the virtual machine is Azure AD joined.
All right, that wraps up this demo. Let's continue on.
All right, now let's take a look
at performing an Azure AD Domain Services Domain Join.
Now there are some prerequisites
that you need to be aware of,
and these might seem pretty obvious
but let's cover them off anyway.
Firstly, you're obviously going to need
Azure AD Domain Services enabled for your tenant,
and then you'll need to have DNS configured
for your virtual network
so that your virtual machines can locate
the managed domain controllers,
and your virtual machines will also need
network connectivity to the domain controllers.
And if they're in a separate virtual network
you might require virtual network peering.
And there also can't be any network security groups
blocking access to the managed domain controllers.
Now let's take a look at the methods you can use
to perform an Azure AD Domain Services Domain Join.
Firstly, you can use the traditional on-premises methods
we explored earlier in the course
by logging onto the VM and using Server Manager
or the AD computer PowerShell cmdlet
to perform the domain join.
But you also get some additional methods.
You can use PowerShell
using the Set-AzVMAdDomainExtension PowerShell cmdlet
to join the virtual machine to the managed domain
without logging onto the virtual machine.
Or you can use an ARM template
using the JsonADDomainExtension virtual machine extension.
And here's an excerpt from an ARM template
and I'll link to some additional details on this method,
if you want to take a look at this.
All right, let's take a look at a demo
of performing an Azure AD Domain Services domain join.
We have a VM that we want to use
to manage our Azure AD Domain Services managed domain.
But before we can do that,
we need to domain join that virtual machine
and we'll perform the domain join
using the PowerShell methods shown here.
Let's take a look.
All right, let's domain join this VM AZ-AUE-ADM01
to our Azure AD Domain Services managed domain.
Before we begin,
we need to verify that this VM is configured
to use the managed domain controllers as DNS servers.
To do that, we'll navigate to the virtual machine networking
and then we'll navigate to the network interface
for this virtual machine,
and then we'll navigate to DNS servers under settings.
And we can see here
that this virtual machine is configured
to use the IP addresses of our managed domain controllers
as DNS servers.
Now lets choose Azure PowerShell in Cloud Shell
to perform the Domain Join.
We'll navigate to Cloud Shell
and we can see we're using PowerShell.
And now we'll just type clear
to clear out the Cloud Shell text.
All right, and now we can go ahead and join the domain
using the Set-AzVMAdDomainExtension PowerShell cmdlet.
And then we need to provide the domain name,
which in our instance is az.barrierreefaudio.com.
And then we need to provide the VM name,
which in our instance is AZ-AUE-ADM01.
And then we need to provide the resource group name,
which in our instance is rg-australiaeast-administration.
And now we need to provide a friendly name
for the installed extension.
And this is the name that will appear
in the list of extensions installed on this virtual machine
if you navigate to the extensions blade
for the virtual machine. So
I'm going to go ahead and just provide the name DomainJoin.
And now I'm just going to indicate
that we'd like to restart the virtual machine
as part of the domain join process
with the Restart parameter.
And then I'm going to request PowerShell
to Get-Credentials from me
using the Get-Credential PowerShell cmdlet
and passing that to the Credential parameter,
and then I'm just going to specify the join option.
And the join option is used to specify
whether you'd like to join a work group or a domain,
and whether you'd like to create an existing account.
I'm going to specify the join option of 3,
which indicates that I'd like join
an Active Directory domain
and I'd like to create a new computer account
for this virtual machine.
So I'll go ahead and specify 3 for the join option.
And I've just gone ahead and pasted that in there
because it has to be in hexadecimal format.
I'm not 100% sure
what the Azure PowerShell team was thinking
when they provided this parameter,
but we'll go ahead and run that now.
We'll go ahead and provide the username and password.
Now for the purpose of this domain join,
I've gone ahead and added a user account
to the AAD DC Administrators Azure AD group
and I'm going to use that user's credentials
to perform the domain join.
All right, and this will just take a moment to complete.
So we'll come back when this is done.
All right, and that domain join is now complete.
So if we navigate back to the virtual machine
and then we navigate into Extensions under Settings,
and we can see we have that domain join extension
successfully installed.
All right, that concludes this demo.
Let's go ahead and wrap up with a bit of a summary
of what we've covered in this lesson.
All right, so what have we covered in this lesson?
Azure AD Domain Join provides secure login and authorization
using Azure role-based access control.
And to connect to an Azure AD joined VM,
you need either the Virtual Machine Administrator Login
or the Virtual Machine User Login role
associated with your user account.
And to join an Azure VM
to a managed Azure AD Domain Services domain,
you must have network connectivity and DNS configured
on the virtual machine you wish to join.
And you can join an Azure VM to a managed domain
using the Set-AzVMAdDomainExtension PowerShell cmdlet.
Another awesome PowerShell cmdlet to remember.
All right, thanks for being with me in this lesson.
And I hope you found it useful.
And I look forward to seeing you on the next lesson.