AVD join to on premise domain

ADM Bartlomiej Belko 0

We have a Azure host pool with VMs joined to Azure AD only. There is a network connectivity to our on premise domain but some 3rd party apps are not working as expected - these are tools to manage on premise domain. Is it possible to have hybrid scenario now? To join existing AVD into on premise domain?

Nikhil Duserla 2,830 Reputation points Microsoft Vendor

2024-10-28T16:02:07.5766667+00:00
Hi @ADM Bartlomiej Belko,

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

Yes, it is possible to join Azure Virtual Desktop (AVD) to an on-premises domain in a hybrid scenario.

Organizations with existing Active Directory implementations can benefit from some of the functionality provided by Microsoft Entra ID by implementing Microsoft Entra hybrid joined devices. These devices are joined to your on-premises Active Directory and registered with Microsoft Entra ID.

Microsoft Entra hybrid joined devices require network line of sight to your on-premises domain controllers periodically. Without this connection, devices become unusable. If this requirement is a concern, consider Microsoft Entra joining your devices.

Configure Microsoft Entra hybrid join: https://learn.microsoft.com/en-us/entra/identity/devices/how-to-hybrid-join?source=recommendations

Microsoft Entra Connect version 1.1.819.0 or later.

Don't exclude the default device attributes from your Microsoft Entra Connect Sync configuration. To learn more about default device attributes synced to Microsoft Entra ID, see Attributes synchronized by Microsoft Entra Connect.

If the computer objects of the devices you want to be Microsoft Entra hybrid joined belong to specific organizational units (OUs), configure the correct OUs to sync in Microsoft Entra Connect. To learn more about how to sync computer objects by using Microsoft Entra Connect, see Organizational unit–based filtering.

Hybrid Identity Administrator credentials for your Microsoft Entra tenant.

Enterprise administrator credentials for each of the on-premises Active Directory Domain Services forests.

(For federated domains) At least Windows Server 2012 R2 with Active Directory Federation Services installed.

Users can register their devices with Microsoft Entra ID. More information about this setting can be found under the heading Configure device settings, in the article, Configure device settings.

If you have any further queries, do let us know.

If the answer is helpful, please click "Accept Answer" and "Upvote it."
ADM Bartlomiej Belko 0 Reputation points

2024-10-29T07:43:14.1566667+00:00

Thanks for the replay. But in short, what are the steps which I should do on AVD machine which is in Azure AD and has line of sight to our on premise AD? I put a screenshot from this machine and there is no button to join to domain|
ADM Bartlomiej Belko 0 Reputation points

2024-10-29T07:44:15.4466667+00:00

here is the screenshot
Nikhil Duserla 2,830 Reputation points Microsoft Vendor

2024-10-29T11:37:02.4133333+00:00

Hi ADM Bartlomiej Belko,

Thank you for sharing information.

In On-prem Navigate to Server roles and tick Active Directory Domain services and install it. After installation, In Deployment configuration click on new forest and add your domain. Once configuration done from domain. Please Install Microsoft Entra Connect Sync and configure it-https://learn.microsoft.com/en-us/entra/identity/devices/how-to-hybrid-join?source=recommendations#managed-domains

Once all the users are synchronized from On-prem to azure cloud Entra ID. You can check in Microsoft Entra ID.

Please go through this link for deployment steps of AVD-https://learn.microsoft.com/en-us/entra/identity/devices/how-to-hybrid-join?source=recommendations#managed-domains

If you have any further queries, do let us know.
ADM Bartlomiej Belko 0 Reputation points

2024-10-29T12:02:00.0666667+00:00

We already have on prem domain installed and MS Entra connect sync is in place. We are able to use e.g. autopilot to have hybrid joined machines. My question is specifically for AVD (Azure virtual desktop) machines which are build as host pool machines in Azure only. Can we join such machine manually to on prem AD?
Nikhil Duserla 2,830 Reputation points Microsoft Vendor

2024-10-29T16:12:18.77+00:00

Hi ADM Bartlomiej Belko,

Thank you for reaching us again.

I will check with our team internally and get back to you soon.
Nikhil Duserla 2,830 Reputation points Microsoft Vendor

2024-11-01T19:23:46.59+00:00

Hi @ADM Bartlomiej Belko,

Have you reviewed or gone through the answer provided by Prrudram above? Let me know if you have any questions.

If it is helpful for your question, please accept this as an answer as a token of appreciation.

1 answer

Prrudram-MSFT 25,321 Reputation points

2024-10-30T13:01:12.1733333+00:00

Hi @ADM Bartlomiej Belko

I have reviewed your conversation with Nikhil above. One thing you can do is to join them to the AD during provisioning flow in the portal. Also, I would suggest to deploying a pair of domain controllers (across AZs) to Azure in the same region(s) that AVD Host Pools will be deployed. Authentication is critical along with any GPOs that get applied (such as for FsLogix) and you want to make sure those DCs are available. Then setup sites & services so the AVD networks prefer their local DCs.
Please sign in to rate this answer.
ADM Bartlomiej Belko 0 Reputation points

2024-11-04T07:47:36.1933333+00:00

I am aware that during provisioning flow we can add machines to on premise domain. But what about existing already built VMs ? This is what is my question

Prrudram-MSFT 25,321 Reputation points

2024-11-05T04:34:48.1166667+00:00

Hi ADM Bartlomiej Belko To join them to an on-premises AD, you need to ensure that the VMs can connect to the on-premises domain controller of the network. Usually, by using a Site-to-Site VPN or an Express Route and also configuring DNS resolution properly on the VNET.

If I have answered your question, please accept this as answer as a token of appreciation.

ADM Bartlomiej Belko 0 Reputation points

2024-11-06T09:21:16.1533333+00:00

There is already line of sight do on prem domain - so from network perspective all is fine. How to do it exactly on Win11 VM? As you can see from screenshots which I shared above there is no button in System properties window to join to domain

Prrudram-MSFT 25,321 Reputation points

2024-11-07T06:28:53.3233333+00:00

Hello ADM Bartlomiej Belko There is no button as such to join, its basically change button https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/join-a-computer-to-a-domain
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

AVD join to on premise domain

1 answer

Your answer