Condividi tramite

Step-By-Step: Creating an Organizational Unit in an Azure AD Domain Service Managed Domain

  • Articolo

Organizational units (OU) in Active Directory are containers where users, computers, groups and other organization units are placed. These containers help create Active Directory's logical structure and can be used to assign group policies & manage the resources.  This is common procedure in in-house domain environment.

The same strategy can also be enabled in Azure Managed Domains with however, some limitations. Managed domains do not offer full control over the functions such as complex group policies etc. I will explain those in later article but for the Organizational units, we can create those and manage those in azure managed domain. There is no option in azure portal to create this, this need to be created using a PC, server which is connected to the Azure Ad managed domain.

You also need be a member of AAD DC Administrators group.

Let’s see how we can create OU.

In my demo I am using a windows 2016 TP5 server which is connected to managed domain. Also I logged in as a member of AAD DC Administrators group.

ou1

Also I have already installed AD DS and AD LDS Tools (Remote server administration tools > Role administration tools > AD DS and AD LDS Tools)

ou2

To start the process, go to Server Manager > Tools > Active Directory Administrative Center ou3

In left hand side in the console click on the managed domain ou4

In the right hand under the Tasks click on New > Organizational Unit ou5

In next window we can provide the information about new OU and click OK to complete.

ou6

Then you can see the new OU added.

ou7

By default the user account I used for to create the OU got full permissions to control the OU.

ou8

Now you can create new users, groups under this OU. But keep in mind you CANNOT move any users, groups which is already under AADDC users OU. It’s the default OU for the users, groups added via azure portal.

ou13

NOTE:  The users and groups added under new OU will not be visible on azure portal. It’s only valid inside the managed domain environment.