If you’re using AD Federation Services (AD FS) or a third-party federation service to route all authentication back on premises, this won’t work for you. The first requirement is that you use password synchronization. Most businesses have AD on premises and will want to extend that to the cloud without extra infrastructure to maintain. The scenario with a company only in the cloud will be a very small minority. Azure AD Domain Services for hybrid organizations ^ There are no DCs to manage and no AD replication to manage it’s all provided as a service. For a cloud-only tenant that doesn’t have an on-premises AD infrastructure, the workflow is straightforward: enable the Azure AD directory for AAD DS corporate users can then log in to cloud VMs using Remote Desktop, and VMs in Azure Virtual Networks can take advantage of Group Policy, Kerberos, and LDAP. Let’s look at what it offers, what’s missing, and how to set it up. AAD DS is the service that this article covers: Azure Active Directory Domain Services.

You can link your on-premises AD to the cloud AAD using AAD Connect. AD is the on-premises Active Directory most business use today, and AAD is Azure Active Directory that underlies all Office 365 tenants as well as identities you use in Azure. There are lots of “AD” acronyms, so let’s sort them out before we go any further.

In early October 2015, Microsoft introduced an alternative: AD as a service. This is a fair bit of infrastructure to manage (and pay for). So, at a minimum, you have to have one or two VMs running as Domain Controllers (DCs) and DNS servers, with a hybrid network ( Site-to-Site VPN or ExpressRoute) back to your corporate datacenter.

Azure active directory domain services