I currently have three on-premises Active Directory domain controllers and will be deploying several virtual machines in Azure. I'm planning to add two domain controllers in Azure as well. The Azure and on-premises environments will be connected through ExpressRoute and use separate network ranges. How should I configure Active Directory so Azure VMs prefer the Azure-based domain controllers, while on-premises machines prefer the local domain controllers?
3 Answers
Configure the Azure VNet DNS settings to point to the Azure domain controllers so Azure VMs resolve and locate them first. On-premises DHCP or DNS should continue directing local machines to the on-premises domain controllers. DNS settings alone aren’t a replacement for AD Sites and Services, though—the site and subnet configuration is what controls domain controller selection and replication behavior.
Create separate Active Directory Sites for the on-premises network and Azure. Put the existing domain controllers in the on-premises site, the new Azure domain controllers in the Azure site, and associate each site with its correct IP subnets. Domain-joined machines use this site and subnet information to locate local domain controllers first, while still being able to fail over across the ExpressRoute connection if needed.
When creating the Azure domain controllers, follow Microsoft’s deployment guidance rather than using the default VM configuration. In particular, use a separate data disk for the Active Directory database and SYSVOL, disable host caching on that disk, and plan replication and backup carefully. Azure networking also handles DHCP differently from a traditional on-premises network, so account for that when designing the VM configuration.
Also configure the AD site link and its cost between Azure and on-premises so replication follows the intended path. Local domain controllers should be preferred, with the remote site available for failover.
Make sure you have a clear, non-overlapping IP addressing plan for the Azure VNets before creating the sites and subnet associations.