Microsoft Entra Domain Services
What it is
Microsoft Entra Domain Services is a managed domain service for Azure workloads that need selected AD DS-compatible features. It provides domain join, Group Policy, LDAP, and Kerberos/NTLM authentication while Microsoft operates the domain controllers.
Why it exists
A legacy application may require domain services but an organization may not want to deploy, patch, monitor, and recover its own domain controllers. Entra Domain Services provides that compatibility layer and uses Microsoft Entra ID as the source of authority for users, groups, and credentials.
Think of it as a managed translation desk for older applications. It lets them use familiar domain protocols while the organization keeps modern identity management centered in Entra ID. It is a bridge for a specific compatibility need, not a reason to keep every new application on legacy authentication.
Key ideas
- Microsoft manages the domain controllers in the managed domain, including availability, backups, patching, and encryption at rest. The customer still designs the virtual network, connected workloads, administration, and application permissions.
- Information synchronizes one way from Entra ID into the managed domain. A managed domain is a standalone domain, not an extension of an on-premises AD DS domain.
- It supports domain join, Group Policy, secure LDAP, and Kerberos/NTLM for suitable workloads. LDAP writes are limited to objects created in the managed domain; objects synchronized from Entra ID are not a general writable copy.
- A replica set can improve availability or support disaster-recovery scenarios for legacy workloads. It does not make every dependent application automatically resilient.
- New, cloud-native applications should normally use Entra ID directly and modern authentication such as OIDC or OAuth, rather than adding a domain dependency.
Not the same as
- Microsoft Entra ID — the cloud identity service; it does not itself provide a managed AD DS domain.
- AD DS — self-managed Windows Server domain services, with full domain-controller operational responsibility.
- azure-vm — the virtual machines that can join the managed domain; they are not the service itself.
Operational failure mode
Entra Domain Services reduces domain-controller administration, but it does not make a legacy workload cloud-native. Confirm its required protocols, DNS, virtual-network connectivity, and identity synchronization before migration. Use Entra ID directly when modern authentication satisfies the workload.
Northwind example
Northwind moves an older warehouse application to Azure. The application requires LDAP lookups and domain join, but rewriting it for modern authentication would take time. Maya deploys Entra Domain Services in a suitable virtual network and verifies that the application’s users synchronize from Entra ID, DNS resolves correctly, and the application can use only the permissions it needs. New Northwind services continue to use Entra ID directly rather than joining the managed domain.
Domain Services versus AD DS and Entra ID
| Need | Start by considering |
|---|---|
| Legacy Azure workload needing domain protocols without managing domain controllers | Entra Domain Services |
| Full domain-controller control or an existing AD DS design to operate | [[active-directory-domain-services |
| Modern cloud application identity and sign-in | [[entraid |
Common confusion
- Entra Domain Services does not give customers full domain-controller administration or make it an on-premises AD DS extension.
- Synchronization from Entra ID does not mean every external-directory identity or every AD DS write behavior is available in the managed domain.
- Managed domain services do not decide whether an application user may view a Northwind order; the application still enforces business authorization.
Related
active-directory · active-directory-domain-services · entraid · vnet · azure-vm
Sources and re-audit
- Microsoft Learn — Overview of Microsoft Entra Domain Services, checked 2026-09-16.