Create Azure AD Domain Services

Change SKU to standard from enterprise to save some cost. 

Succeed:

Check DNS server ip addresses after created Azure AD Domain Services:

You will get two DNS server ip addresses, which will be automatically / manuallyconfigured to your VNET configuration. 

Steps to join an Azure cloud Windows server to AAD DS

1 Create a new VM, log into it using your local account

Check IP Address configuration:

2 In the System Properties window, select Change to join the managed domain.

3 In the Domain box, specify the name of your managed domain, such as aaddscontoso.com, then select OK.

4 Enter domain credentials to join the domain. Provide credentials for a user that's a part of the managed domain. The account must be part of the managed domain or Azure AD tenant - accounts from external directories associated with your Azure AD tenant can't correctly authenticate during the domain-join process. It takes a few seconds to join to the managed domain. When complete, the following message welcomes you to the domain:

Install Active Directory administrative tools

You use the same administrative tools in a managed domain as on-premises AD DS environments, such as the Active Directory Administrative Center (ADAC) or AD PowerShell. These tools can be installed as part of the Remote Server Administration Tools (RSAT) feature on Windows Server and client computers. Members of the AAD DC Administrators group can then administer managed domains remotely using these AD administrative tools from a computer that is joined to the managed domain.

To install the Active Directory Administration tools on a domain-joined VM, complete the following steps:

1. If Server Manager doesn't open by default when you sign in to the VM, select the Start menu, then choose Server Manager.

2. In the Dashboard pane of the Server Manager window, select Add Roles and Features.

3. On the Before You Begin page of the Add Roles and Features Wizard, select Next.

4. For the Installation Type, leave the Role-based or feature-based installation option checked and select Next.

5. On the Server Selection page, choose the current VM from the server pool, such as myvm.aaddscontoso.com, then select Next.

6. On the Server Roles page, click Next.

7. On the Features page, expand the Remote Server Administration Tools node, then expand the Role Administration Tools node.

   Choose AD DS and AD LDS Tools feature from the list of role administration tools, then select Next.

   

8. On the Confirmation page, select Install. It may take a minute or two to install the administrative tools.

9. When feature installation is complete, select Close to exit the Add Roles and Features wizard.

Use Active Directory administrative tools

With the administrative tools installed, let's see how to use them to administer the managed domain. Make sure that you're signed in to the VM with a user account that's a member of the AAD DC Administrators group.

1. From the Start menu, select Windows Administrative Tools. The AD administrative tools installed in the previous step are listed.

   

2. Select Active Directory Administrative Center.

3. To explore the managed domain, choose the domain name in the left pane, such as aaddscontoso. Two containers named AADDC Computers and AADDC Users are at the top of the list.

   

4. To see the users and groups that belong to the managed domain, select the AADDC Users container. The user accounts and groups from your Azure AD tenant are listed in this container.

   In the following example output, a user account named Contoso Admin and a group for AAD DC Administrators are shown in this container.

   

5. To see the computers that are joined to the managed domain, select the AADDC Computers container. An entry for the current virtual machine, such as myVM, is listed. Computer accounts for all devices that are joined to the managed domain are stored in this AADDC Computers container.

Common Active Directory Administrative Center actions such as resetting a user account password or managing group membership are available. These actions only work for users and groups created directly in the managed domain. Identity information only synchronizes from Azure AD to Azure AD DS. There's no write back from Azure AD DS to Azure AD. You can't change passwords or managed group membership for users synchronized from Azure AD and have those changes synchronized back.

You can also use the Active Directory Module for Windows PowerShell, installed as part of the administrative tools, to manage common actions in your managed domain.