We're planning disaster recovery for an Azure environment that includes domain controllers providing custom DNS for a virtual network, several member servers, and a SQL database server. We're considering Azure Site Recovery (ASR) for failover if an Azure zone or region becomes unavailable, but I've read that replicating domain controllers with ASR can cause problems. What approach has worked well for others? Should we deploy domain controllers in the secondary region and let Active Directory replicate normally, and should SQL use native replication or another high-availability option instead of ASR?
5 Answers
First define whether you’re protecting against a single-zone outage or a complete regional outage. Zone resilience is usually handled through the application and service architecture, while a regional disaster may require a secondary region that is already partially deployed. Put domain controllers in the required zones, add at least one in the secondary region, and let AD replicate normally. Treat ASR as a fallback for workloads that lack built-in redundancy, and validate the recovery steps in a real test rather than assuming replication alone proves the design works.
A failed domain controller is often easier to replace than to recover. Keep it limited to AD DS and DNS, maintain another DC in a separate region, and rebuild a lost one if necessary after confirming directory health. This is much less complicated than trying to force a recovered DC image back into the domain.
For AD, the extra VM replication cost and complexity usually aren’t worthwhile. A small, always-on domain controller in another zone or region provides redundancy, and AD DS handles its own replication. DNS zones should be available through the domain controllers in both locations.
If you’re using a managed SQL service, a failover group is much simpler. Otherwise, look at SQL availability groups or another native database replication design. Make sure applications use a stable database endpoint or a failover-aware connection strategy instead of pointing directly at one regional server.
It’s generally better not to replicate domain controllers with ASR. Deploy a domain controller in the target region or zone and let Active Directory replicate between them. Keep the DCs focused on AD and DNS rather than adding unrelated roles. For SQL, native options such as availability groups, log shipping, or a warm database replica are usually a better fit than VM-level replication. ASR can still be useful for servers that don’t have a more suitable redundancy method. Have failover runbooks ready, use sensible DNS TTLs, avoid hard-coded endpoints, and test the entire recovery process regularly.
I’ve successfully moved some SQL VMs with ASR, so it can work, but I’d still prefer restoring or replicating the databases with SQL-native tooling where possible.