Skip to content

Commit 3a13220

Browse files
author
Rahul Khengare
committed
Added AADDS Deployment files
1 parent d5e6b1e commit 3a13220

File tree

6 files changed

+414
-0
lines changed

6 files changed

+414
-0
lines changed

‎101-AAD-DomainServices/README.md

+170
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,170 @@
1+
# Azure Active Directory Domain Service (AADDS) template
2+
3+
<a href="https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2Fazure-quickstart-templates%2Fmaster%2F101-AAD-DomainServices%2Fazuredeploy.json" target="_blank">
4+
<img src="http://azuredeploy.net/deploybutton.png"/>
5+
</a>
6+
7+
<a href="http://armviz.io/#/?load=https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2Fazure-quickstart-templates%2Fmaster%2F101-AAD-DomainServices%2Fazuredeploy.json" target="_blank">
8+
<img src="http://armviz.io/visualizebutton.png"/>
9+
</a>
10+
11+
## Table of Contents
12+
13+
1. [Overview](#overview)
14+
2. [Important Notes](#importantnotes)
15+
3. [Pre Deployment Steps](#predeployment)
16+
4. [Deployment](#deployment)
17+
5. [Post Deployment Steps](#postdeployment)
18+
6. [Teardown Deployment](#teardown)
19+
7. [References](#references)
20+
21+
<a name="overview"></a>
22+
23+
## Overview
24+
This template provision an Azure Active Directory Domain Service (AADDS) with required VNET and NSG groups.
25+
26+
<a name="importantnotes"></a>
27+
28+
### Important Notes
29+
30+
* The scripts create manage Azure Active Directory domain services. We recommend creating a new Azure Active Directory (AD) tenant to deploy this solution.
31+
* Subscription tenant should not have existing managed Azure Active Directory Domain Services (AADDS). Azure active directory supports only **one Domain Service per tenant**.
32+
* Domain Name provided as input parameter while deployment should be **verified** within Azure active directory.
33+
* AAD Domain Services requires the chosen subnet to belong to a reserved private range. Use AADDS subnet range within one of the following IP address ranges: 192.168.0.0/16, 172.16.0.0/12, or 10.0.0.0/8.
34+
* Do not run this solution in **production environment/subscriptions**.
35+
* It is recommended you use a clean Windows 10 (or similar) VM to perform the solution to ensure that the correct PowerShell modules get loaded.
36+
* Deployment takes around **40-45 minutes** to complete.
37+
38+
<a name="predeployment"></a>
39+
40+
### Pre Deployment Step
41+
42+
Before proceeding to deployment of the AADDS template, we need to perform following steps.
43+
44+
**Note:** You can perform these steps through portal as well.
45+
46+
#### 1. Install the required Powershell modules
47+
48+
* Install and configure Azure AD PowerShell module
49+
50+
Follow the instructions in the article to [install the Azure AD PowerShell module and connect to Azure AD](https://docs.microsoft.com/powershell/azure/active-directory/install-adv2?toc=%2fazure%2factive-directory-domain-services%2ftoc.json).
51+
52+
* Install and configure Azure PowerShell module
53+
54+
Follow the instructions in the article to [install the Azure PowerShell module and connect to your Azure subscription](https://docs.microsoft.com/powershell/azure/install-azurerm-ps?toc=%2fazure%2factive-directory-domain-services%2ftoc.json).
55+
56+
#### 2. Connect To Azure Active Directory
57+
58+
# Connect to your Azure Account.
59+
Connect-AzureAD -TenantId <Active Directory ID>
60+
61+
#### 3. Register Azure Active Directory Application service principal
62+
63+
# Create the service principal for Azure AD Domain Services.
64+
New-AzureRmADServicePrincipal -AppId "2565bd9d-da50-47d4-8b85-4c97f669dc36"
65+
66+
#### 4. Configure Administrative Group
67+
68+
# Create the delegated administration group for AAD Domain Services.
69+
New-AzureADGroup -DisplayName "AAD DC Administrators" `
70+
-Description "Delegated group to administer Azure AD Domain Services" `
71+
-SecurityEnabled $true -MailEnabled $false `
72+
-MailNickName "AADDCAdministrators"
73+
74+
# Add user to "AAD DC Administrators" group
75+
76+
# First, retrieve the object ID of the newly created 'AAD DC Administrators' group.
77+
$GroupObjectId = Get-AzureADGroup `
78+
-Filter "DisplayName eq 'AAD DC Administrators'" | `
79+
Select-Object ObjectId
80+
81+
# Now, retrieve the object ID of the user you'd like to add to the group.
82+
$UserObjectId = Get-AzureADUser `
83+
-Filter "UserPrincipalName eq '[email protected]'" | `
84+
Select-Object ObjectId
85+
86+
# Add the user to the 'AAD DC Administrators' group.
87+
Add-AzureADGroupMember -ObjectId $GroupObjectId.ObjectId -RefObjectId $UserObjectId.ObjectId
88+
89+
#### 5. Register Resource Provider
90+
91+
# Login to Azure Account
92+
Connect-AzureRmAccount -TenantId <Active Directory ID>
93+
# Register the resource provider for Azure AD Domain Services with Resource Manager.
94+
Register-AzureRmResourceProvider -ProviderNamespace Microsoft.AAD
95+
96+
97+
<a name="deployment"></a>
98+
99+
### Deployment
100+
101+
<a href="https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2Fazure-quickstart-templates%2Fmaster%2F101-AAD-DomainServices%2Fazuredeploy.json" target="_blank">
102+
<img src="http://azuredeploy.net/deploybutton.png"/>
103+
</a>
104+
105+
<p></p>
106+
107+
In case you want to deploy from deployment machine follow below steps,
108+
109+
* Edit the deployment parameter file
110+
* Create resource group
111+
112+
> # Create new resource group
113+
> New-AzureRmResourceGroup -Name <ResourceGroupName> -Location <location>
114+
115+
116+
* Deploy AADDS template
117+
118+
> # Deploy AADDS template
119+
> New-AzureRmResourceGroupDeployment -ResourceGroupName <Resource Group Name> -TemplateParameterFile .\azuredeploy.parameters.json -TemplateFile .\azuredeploy.json -Verbose
120+
121+
122+
**Note:**
123+
* Deployment takes around 40-50 minutes.
124+
125+
<a name="postdeployment"></a>
126+
127+
### Post Deployment Steps
128+
129+
After deploying AAD Domain services it will take around 40 minutes more to get configured internally.
130+
131+
#### 1. Check AADDS status
132+
To check configuration status follow below steps,
133+
Go to Azure portal -> Select AADDS resource group -> select Domain services resource -> see health status is "Running"(refer below image)
134+
135+
![](images\aaddsstatus.png)
136+
137+
#### 2. Update DNS on virtual network
138+
139+
Click on "Configure" button from overview blade to update the DNS server settings to point to the two IP addresses where Azure Active Directory Domain Services is available on the virtual network.
140+
141+
![](images\dnsupdate.png)
142+
143+
#### 3. Enable password hash synchronization
144+
145+
Users cannot bind using secure LDAP or sign in to the managed domain until you enable password hash synchronization to Azure AD Domain Services. We are using cloud-only user accounts. Refer this document for resetting the password and more details.
146+
147+
**Reset AAD User password:** To use the Managed AADDS we need to perform the password hash synchronization.
148+
149+
You need to change the active directory administrator [AADGlobalAdminUser] password. Azure requires 20 minutes to sync the password hashes from Azure AD to manage AADDS.
150+
151+
<a name="teardown"></a>
152+
153+
### Teardown Deployment
154+
Run following powershell command after login to subscription to clear all the resources deployed. Specify resource group name given during deployment.
155+
156+
`Remove-AzureRmResourceGroup -Name <ResourceGroupName> -Force `
157+
158+
159+
Verification steps -
160+
1. Login to Azure Portal / Subscription
161+
2. Check if resource group name given during deployment is cleared.
162+
<p/>
163+
164+
<a name="references"></a>
165+
166+
### References
167+
1. Pre-requisites: https://docs.microsoft.com/en-us/azure/active-directory-domain-services/active-directory-ds-enable-using-powershell
168+
2. Networking Considerations: https://docs.microsoft.com/en-us/azure/active-directory-domain-services/active-directory-ds-networking
169+
3. Password Synchronization: https://docs.microsoft.com/en-us/azure/active-directory-domain-services/active-directory-ds-getting-started-password-sync
170+
4. Troubleshooting Giude: https://docs.microsoft.com/en-us/azure/active-directory-domain-services/active-directory-ds-troubleshooting

‎101-AAD-DomainServices/azuredeploy.json

+211
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,211 @@
1+
{
2+
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
3+
"contentVersion": "1.0.0.0",
4+
"parameters": {
5+
"domainName": {
6+
"type": "string",
7+
"metadata": {
8+
"description": "Domain Name"
9+
}
10+
},
11+
"location": {
12+
"type": "string",
13+
"defaultValue": "[resourceGroup().location]",
14+
"metadata": {
15+
"description": "Location for all resources."
16+
}
17+
},
18+
"domainServicesVnetName": {
19+
"type": "string",
20+
"defaultValue": "domain-services-vnet",
21+
"metadata": {
22+
"description": "Virtual Network Name"
23+
}
24+
},
25+
"domainServicesVnetAddressPrefix": {
26+
"type": "string",
27+
"defaultValue": "10.0.0.0/16",
28+
"metadata": {
29+
"description": "Address Prefix"
30+
}
31+
},
32+
"domainServicesSubnetName": {
33+
"type": "string",
34+
"defaultValue": "domain-services-subnet",
35+
"metadata": {
36+
"description": "Virtual Network Name"
37+
}
38+
},
39+
"domainServicesSubnetAddressPrefix": {
40+
"type": "string",
41+
"defaultValue": "10.0.0.0/24",
42+
"metadata": {
43+
"description": "Subnet prefix"
44+
}
45+
}
46+
},
47+
"variables": {
48+
"domainServicesNSGName": "[concat(parameters('domainServicesSubnetName'), '-nsg')]",
49+
"nsgRefId": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('domainServicesNSGName'))]",
50+
"vnetRefId": "[resourceId('Microsoft.Network/virtualNetworks/', parameters('domainServicesVnetName'))]",
51+
"subnetRefId": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('domainServicesVnetName'), parameters('domainServicesSubnetName'))]",
52+
"PSRemotingSlicePIPAddresses": [
53+
"52.180.179.108",
54+
"52.180.177.87",
55+
"13.75.105.168",
56+
"52.175.18.134",
57+
"52.138.68.41",
58+
"52.138.65.157",
59+
"104.41.159.212",
60+
"104.45.138.161",
61+
"52.169.125.119",
62+
"52.169.218.0",
63+
"52.187.19.1",
64+
"52.187.120.237",
65+
"13.78.172.246",
66+
"52.161.110.169",
67+
"52.174.189.149",
68+
"40.68.160.142",
69+
"40.83.144.56",
70+
"13.64.151.161"
71+
],
72+
"RDPIPAddresses": [
73+
"207.68.190.32/27",
74+
"13.106.78.32/27",
75+
"13.106.174.32/27",
76+
"13.106.4.96/27"
77+
],
78+
"PSRemotingSliceTIPAddresses": [
79+
"52.180.183.67",
80+
"52.180.181.39",
81+
"52.175.28.111",
82+
"52.175.16.141",
83+
"52.138.70.93",
84+
"52.138.64.115",
85+
"40.80.146.22",
86+
"40.121.211.60",
87+
"52.138.143.173",
88+
"52.169.87.10",
89+
"13.76.171.84",
90+
"52.187.169.156",
91+
"13.78.174.255",
92+
"13.78.191.178",
93+
"40.68.163.143",
94+
"23.100.14.28",
95+
"13.64.188.43",
96+
"23.99.93.197"
97+
]
98+
},
99+
"resources": [
100+
{
101+
"apiVersion": "2018-06-01",
102+
"type": "Microsoft.Network/networkSecurityGroups",
103+
"name": "[variables('domainServicesNSGName')]",
104+
"location": "[parameters('location')]",
105+
"properties": {
106+
"securityRules": [
107+
{
108+
"name": "AllowPSRemotingSliceP",
109+
"properties": {
110+
"protocol": "TCP",
111+
"sourcePortRange": "*",
112+
"destinationPortRange": "5986",
113+
"sourceAddressPrefixes": "[variables('PSRemotingSlicePIPAddresses')]",
114+
"destinationAddressPrefix": "*",
115+
"access": "Allow",
116+
"priority": 301,
117+
"direction": "Inbound"
118+
}
119+
},
120+
{
121+
"name": "AllowRDP",
122+
"properties": {
123+
"protocol": "TCP",
124+
"sourcePortRange": "*",
125+
"destinationPortRange": "3389",
126+
"sourceAddressPrefixes": "[variables('RDPIPAddresses')]",
127+
"destinationAddressPrefix": "*",
128+
"access": "Allow",
129+
"priority": 201,
130+
"direction": "Inbound"
131+
}
132+
},
133+
{
134+
"name": "AllowSyncWithAzureAD",
135+
"properties": {
136+
"protocol": "TCP",
137+
"sourcePortRange": "*",
138+
"destinationPortRange": "443",
139+
"sourceAddressPrefix": "*",
140+
"destinationAddressPrefix": "*",
141+
"access": "Allow",
142+
"priority": 101,
143+
"direction": "Inbound"
144+
}
145+
},
146+
{
147+
"name": "AllowPSRemotingSliceT",
148+
"properties": {
149+
"protocol": "TCP",
150+
"sourcePortRange": "*",
151+
"destinationPortRange": "5986",
152+
"sourceAddressPrefixes": "[variables('PSRemotingSliceTIPAddresses')]",
153+
"destinationAddressPrefix": "*",
154+
"access": "Allow",
155+
"priority": 302,
156+
"direction": "Inbound"
157+
}
158+
}
159+
]
160+
}
161+
},
162+
{
163+
"apiVersion": "2018-06-01",
164+
"type": "Microsoft.Network/virtualNetworks",
165+
"name": "[parameters('domainServicesVnetName')]",
166+
"location": "[parameters('location')]",
167+
"properties": {
168+
"addressSpace": {
169+
"addressPrefixes": [
170+
"[parameters('domainServicesVnetAddressPrefix')]"
171+
]
172+
}
173+
},
174+
"dependsOn": [
175+
"[variables('domainServicesNSGName')]"
176+
],
177+
"resources": [
178+
{
179+
"apiVersion": "2018-06-01",
180+
"type": "subnets",
181+
"location": "[parameters('location')]",
182+
"name": "[parameters('domainServicesSubnetName')]",
183+
"dependsOn": [
184+
"[parameters('domainServicesVnetName')]"
185+
],
186+
"properties": {
187+
"addressPrefix": "[parameters('domainServicesSubnetAddressPrefix')]",
188+
"networkSecurityGroup": {
189+
"id": "[variables('nsgRefId')]"
190+
}
191+
}
192+
}
193+
]
194+
},
195+
{
196+
"type": "Microsoft.AAD/DomainServices",
197+
"name": "[parameters('domainName')]",
198+
"apiVersion": "2017-06-01",
199+
"location": "[parameters('location')]",
200+
"properties": {
201+
"domainName": "[parameters('domainName')]",
202+
"vnetSiteID": "[variables('vnetRefId')]",
203+
"subnetId": "[variables('subnetRefId')]"
204+
},
205+
"dependsOn": [
206+
"[parameters('domainServicesVnetName')]"
207+
]
208+
}
209+
],
210+
"outputs": {}
211+
}

0 commit comments

Comments
 (0)