I've setup an Azure AD, and I've been able to successfully join my RM VM instances to this domain. However even when logged in with a Global Administrator account, I'm unable to make any changes to the directory. I don't have the options to add or remove users, or groups, or Org Units etc. The Directory seems to be readonly.

The only way I can make changes to the directory, is through the Azure portal.

I can't find any references to this particular issue anywhere online, so I suspect it must just be something weird with my setup. I must have missed a step somewhere. I've checked through all the admin screens I can find for the AAD, but cannot find anything mentioning allowing write access to the domain.

One of the VM's is running Server 2012 R2, and the other is running Server 2016.

Update... I've found that while I can't make changes to any of the existing OU's, groups, or users, I can add a new top level OU, and then in there add whatever I like. This partially solves my problem. However the next issue is that these new users I add, don't seem to appear in the Azure Portal.

So it seems I can manage users either in the portal, or using the domain management utilities in Windows, but I can't do both.

I just found this... Warning User accounts, groups, service accounts, and computer objects that you create under custom OUs are not available in your Azure AD tenant. In other words, these objects do not show up using the Azure AD Graph API or in the Azure AD UI. These objects are only available in your Azure AD Domain Services managed domain.

So this just seems to be one of the limitations of AAD Domain Services.

  • Hi, based on my knowledge, you only could join Windows 10 to Azure AD. Do you mean join Azure DS? – Shui shengbao Mar 9 '17 at 7:49
  • Azure Active Directory. I'm not sure what Azure DS is. – user1751825 Mar 9 '17 at 7:55
  • I've enabled Domain Services on the AD. Is that what you mean by Azure DS? – user1751825 Mar 9 '17 at 7:59
  • Yes. Windows Server 2012 R2 could not join Azure AD – Shui shengbao Mar 9 '17 at 8:02
  • The synchronization process between Azure AD and Azure DS is one-way. Users are created by Azure DS could not sync to Azure AD. – Shui shengbao Mar 9 '17 at 8:24

So this just seems to be one of the limitations of AAD Domain Services.

Yes, you had better to understand Synchronization from your Azure AD tenant to your managed domain

User accounts, group memberships, and credential hashes are synchronized from your Azure AD tenant to your Azure AD Domain Services managed domain.

The synchronization process is also one-way/unidirectional in nature. Your managed domain is largely read-only except for any custom OUs you create. Therefore, you cannot make changes to user attributes, user passwords, or group memberships within the managed domain. As a result, there is no reverse synchronization of changes from your managed domain back to your Azure AD tenant.

  • Thanks, this is exactly what I needed. I hadn't realised that AAD and Azure DS were somewhat distinct services. I'm much clearer now on how they work together. – user1751825 Mar 9 '17 at 8:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.