Now let's turn our attention to joining Windows Server to
different types of domains, Active Directory Domain Services,
Azure AD Domain Services, and Azure AD itself.
Now we really don't have to do the first bit because I already
showed you how to join an Active Directory Domain Services domain,
as well as promote a domain controller, but we do want to look at
the second and third options here.
I'm actually going to start with the question,
how can we join a Windows Server virtual machine running in
Azure to our Azure Active Directory tenant? Now this is a
special case scenario. Azure AD does have some mobile device
management, or MDM, capabilities,
but it's intended mainly for endpoint management, in other words,
Windows 10 devices.
And even actually, if you're using Microsoft Intune, you can bring in iOS
devices and Android devices. But in terms of your Azure servers,
you probably aren't going to have administrators signing
in interactively those servers, so mobile device
management is kind of a moot point.
However, you can in Azure perform an Azure AD sign‑in to your Windows Server
Azure VMs. There's a couple ways you can implement that. One, what you see on
this slide is during virtual machine creation,
you can, in the portal anyway,
click the checkbox Login with Azure AD. Now notice, it says in the yellow
highlight RBAC role assignment is going to be required in order for your
administrators to sign into the VM with Azure AD credentials.
And also another requirement you see up above where it says
Identity, System managed Identity must be on to log on with
Azure AD credentials. Now first,
let me actually take a step back yet again and ask why are you interested in
signing into an Azure VM with an Azure AD credential? This is not a case where
you're mixing and matching local Active Directory with Azure Active Directory.
I want to be really clear about that.
So this particular model would be for cloud‑first Windows
Server Azure VMs, on which you want your people,
whoever those administrators or developers or people are, to be able to sign
into those VMs, either as a standard user or as an administrator using not
local credentials, but Azure AD credentials.
That's the specific use case we're talking about here, okay? Now another
opportunity or another point to consider that's actually a requirement besides
loading the extension that joins the Azure server to Azure AD, as I mentioned in
the previous slide in that little point there,
there are two built‑in RBAC roles that are required.
You have to be actually assigned one or both of these roles.
It's Virtual Machine Administrator Login or Virtual Machine User Login.
So this means that just enabling a Windows Server Azure VM for Azure AD
sign‑in will not get you there. Even if you're a subscription owner, if
you have top‑tier permissions on the VM, in order to sign into that VM
with Azure AD credentials,
you would also need to be assigned the Virtual Machine Administrator Login if
you want to sign in as a local administrator or Virtual Machine User Login if
you want to sign in as a standard user. It's important. Now I also want you to
see here in this portal screenshot,
there's a third built‑in role, and this is an exam alert. You need to be
straight on this before you take your AZ‑800 exam.
There's a built‑in virtual machine contributor role as well, and that has
nothing to do with sign‑in. In fact, it's just the opposite.
You would assign the virtual machine contributor built‑in RBAC
role to administrators that will manage the VM resource in Azure
who would have permissions to start, stop, and restart the VM, run backup jobs,
resize the VM, but they would not have any privileges to sign into the VM.
So there's a separation of duties there between the control plane
and data plane, and that's as it should be, in my humble opinion.