Entra Domain Services considerations

Question

Hi All!

I am considering using Entra domain services (PaaS) as an option for extending (not replacing) our AD infrastructure into the cloud (as opposed to sticking a VM in Azure with AD running on it).

It looks like a good option since I like the idea of keeping on premise and cloud AD domains separate, also Microsoft will take ownership of updates and failover it would seem with this service.

I have had a good look through all the documentation however a couple questions still remain.

• I read that it is recommended to use a DNS domain name that you "own" I would take this as a publicly owned DNS name - is this really needed since I also read that the service would not be publicly accessible, why would this need a publicly owned DNS? would local suffice?
• SKU's as per the below, why is Enterprise cheaper than premium, unless I've read this wrong the main difference between Enterprise and Premium was daily backups vs 3 day backups (note that Standard is not an option as we would like support for forest trust).

Any help with this would be appreciated, also any best practice setup or things to do/avoid would be very useful - this service would mainly be used for moving legacy on premise applications to the cloud so support for a legacy AD type environment is what I want to achieve here.

Answer 1

Regarding the publicly registered DNS name, you are correct - this is not required. However, you might want to consider implementing it for a number of reasons:

• Uniqueness: It ensures no conflict with existing domain names within or outside your organization, especially if you later need to integrate with other services or external partners.
• Future-proofing: Even though Entra Domain Services is not publicly accessible, a publicly registered DNS name avoids potential conflicts with global DNS namespaces.

Regarding Enterprise vs. Premium SKU

• As you pointed out, the Premium SKU includes the additional capability (daily backup frequency) that caters to specific, high-demand scenarios where recovery points need to be more frequent.

More at https://learn.microsoft.com/en-us/entra/identity/domain-services/administration-concepts#azure-ad-ds-skus

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin