How Can Azure VMs Prefer Azure Domain Controllers Over On-Premises DCs?

Create separate Active Directory Sites for the on-premises network and Azure. Associate each site with its correct IP subnets, place the Azure domain controllers in the Azure site, and place the existing controllers in the on-premises site. Clients use site and subnet information to locate domain controllers in their local site, while still being able to fail over across the ExpressRoute connection if necessary. Make sure the Azure and on-premises address spaces do not overlap, and configure the site link costs and replication schedule appropriately.

Have an IP addressing plan ready before deploying the Azure networks. After creating the Azure AD site and assigning its subnets, configure the Azure virtual network DNS settings to point to the Azure domain controllers. That helps Azure VMs find the local controllers instead of relying on the on-premises DNS servers. Make sure the domain controllers themselves have reliable DNS configuration and can resolve both locations.

Deploy the Azure domain controllers according to the platform’s recommended design. For example, use a separate managed disk for the Active Directory database and SYSVOL, and disable host caching on that disk where required. Also plan for services such as DHCP, since Azure networking does not provide the same DHCP model as a traditional on-premises network.

You can also use appropriate site-link costs and network metrics so local domain controllers are preferred over remote ones. DNS configuration is important, but DNS alone does not replace properly configured Active Directory Sites and Services; both should be designed together.