Microsoft Entra Domain Services

Domain Services is a part of Microsoft Entra, the Microsoft product family for multicloud identity and access solutions.

No. You can create a single managed domain serviced by Microsoft Entra Domain Services for a single Microsoft Entra tenant.

Yes. Domain Services can be enabled in an Azure Resource Manager virtual network. Classic Azure virtual networks are no longer available when you create a managed domain.

No. Guest users invited to your Microsoft Entra tenant using the Microsoft Entra B2B invite process are synchronized to your Domain Services managed domain. However, as passwords for these users aren't stored in your Microsoft Entra tenant, Domain Services has no way to synchronize NTLM and Kerberos hashes for these users to your managed domain, so they can't sign in or join computers to the managed domain.

Yes. Each Domain Services managed domain includes two domain controllers. You don't manage or connect to these domain controllers—they're part of the managed service. If you deploy Domain Services into a region that supports availability zones, the domain controllers are distributed across zones. In regions that don't support availability zones, the domain controllers are distributed across availability sets.

Changes made in your Microsoft Entra tenant using either the Microsoft Entra admin center or PowerShell are automatically synchronized to your managed domain. This synchronization process runs in the background. There's no defined time period for this synchronization to complete all the object changes.

No. Once you've enabled a Domain Services managed domain, the service is available within your selected virtual network until you delete the managed domain. There's no way to pause the service. Billing continues on an hourly basis until you delete the managed domain.