I've setup an Azure AD, and I've been able to successfully join my RM VM instances to this domain. However even when logged in with a Global Administrator account, I'm unable to make any changes to the directory. I don't have the options to add or remove users, or groups, or Org Units etc. The Directory seems to be readonly.
The only way I can make changes to the directory, is through the Azure portal.
I can't find any references to this particular issue anywhere online, so I suspect it must just be something weird with my setup. I must have missed a step somewhere. I've checked through all the admin screens I can find for the AAD, but cannot find anything mentioning allowing write access to the domain.
One of the VM's is running Server 2012 R2, and the other is running Server 2016.
Update... I've found that while I can't make changes to any of the existing OU's, groups, or users, I can add a new top level OU, and then in there add whatever I like. This partially solves my problem. However the next issue is that these new users I add, don't seem to appear in the Azure Portal.
So it seems I can manage users either in the portal, or using the domain management utilities in Windows, but I can't do both.
I just found this... Warning User accounts, groups, service accounts, and computer objects that you create under custom OUs are not available in your Azure AD tenant. In other words, these objects do not show up using the Azure AD Graph API or in the Azure AD UI. These objects are only available in your Azure AD Domain Services managed domain.
So this just seems to be one of the limitations of AAD Domain Services.