Alright, let me close that RDP session, and let's come back to our portal again.
And what I want to do here is head on over to my Virtual networks list, and
this cloud‑vnet, actually we're going to go to another one I created called
aadds, boy, that's a tongue twister, vnet. It's got an address space of
172.17/16, and I have just two subnets here.
This is going to be my testbed for Azure AD Domain Services.
But if I do a search in the Azure portal for Azure AD Domain
Services and head on over to that blade,
let's create our managed domain.
I'm going to place this in my cloud‑rg resource group, and I'm going
to call this aaddstimw.info as my domain name.
Now the Forest type defaults to User, but you can also use the Resource option.
What's going on here is that you would use the resource option if you had
resources in your Azure VNet and you wanted to include local Active Directory
users and groups on those access control lists.
What would happen is that you would have a unidirectional
forest trust from your managed domain in the cloud to
your on‑premises environment.
But the most common scenario is, as I explained before for application migration,
so we're going to leave User here, and we'll click Next. We supply
the name of the virtual network and the subnet. I already popped that
in. It tells us here that a network security group will be
automatically created and associated to the subnet to protect these
managed domain controllers.
We have our AAD DC administrators who has
administrative privileges in the managed domain.
Let's click Manage group membership,
Add members, and I'm just going to add myself right now.
There's my Tim account, Select.
Alright,
let me close. I'll leave the default notifications, All Global
Administrators, as well as the AAD DC Administrators group.
How do we want synchronization to happen?
Notice that it's a one‑way synchronization from Azure Active Directory to
the managed domain. In the next module, I'll configure that second hop, or
really, it's the first hop where we use Azure AD Connect to replicate
local identities up into Azure, and then you've got one way from Azure AD
into the managed domain.
Do you want to bring everybody or do you want to scope that synchronization?
I'm going to do everybody because my Azure AD isn't particularly large.
Let me click Next.
We have some options here,
including some important ones like making sure that password
synchronization from on‑premises is enabled.
I'm going to click Next.
We've got our taxonomic tags. We'll validate our deployment choices against
the Azure Resource Manager schema, and then we'll create.
Now let's take a look at this warning together.
It says the following choices are final.
So basically, everything we selected, it's essentially a tattoo
operation that if we decide that we made a mistake somewhere in the
mix, we're going to have to wipe and reload.
Let me click OK.
And this will normally take upwards to an hour. And I'm going to let this go.
You don't have to wait for it to complete, fortunately. What I will do in
the meantime just to get us started is show you if we browse over to the
Azure AD Domain Services blade in the portal,
we can take a look, even though the resource is being created, and it
says, this operation will take a while. Eventually,
we'll have additional instructions,
particularly instructions on how to configure DNS in our
virtual network to point to the two managed domain controllers
that you get as part of this service.
And you notice here, there's some related docs links, which are useful, and we
can see some Azure control plane options here under Settings.
I'm actually going to end the demo here, and we'll complete the Azure AD DS configuration in the next module.