Entra Domain Services uses minimum SKU

May 20, 2025 ยท View on GitHub

SYNOPSIS

The default SKU for Microsoft Entra Domain Services supports resiliency in a single region.

DESCRIPTION

By default, Microsoft Entra Domain Services (Azure AD DS) deploys a replica set in a single region. When using the Standard SKU, only a single replica set is supported. To deploy a replica set across multiple regions, a minimum of the Enterprise SKU must be used. Both the Enterprise and Premium SKUs support cross-region replication.

Deploying a replica set in multiple regions provides resiliency against region failures for this identity service. Even if multiple regions is not required for supporting running applications across multiple regions, it is often a requirement for disaster recovery.

RECOMMENDATION

Consider using a minimum Enterprise SKU to support resiliency across multiple regions.

EXAMPLES

Configure with Bicep

To deploy domains that pass this rule:

  • Set the properties.sku property to Enterprise or Premium.

For example:

resource ds 'Microsoft.AAD/domainServices@2022-12-01' = {
  name: name
  location: location
  properties: {
    sku: 'Enterprise'
    ldapsSettings: {
      ldaps: 'Enabled'
    }
    domainSecuritySettings: {
      ntlmV1: 'Disabled'
      tlsV1: 'Disabled'
      kerberosRc4Encryption: 'Disabled'
    }
    replicaSets: [
      {
        subnetId: primarySubnetId
        location: location
      }
      {
        subnetId: secondarySubnetId
        location: secondaryLocation
      }
    ]
  }
}

Configure with Azure template

To deploy domains that pass this rule:

  • Set the properties.sku property to Enterprise or Premium.

For example:

{
  "type": "Microsoft.AAD/domainServices",
  "apiVersion": "2022-12-01",
  "name": "[parameters('name')]",
  "location": "[parameters('location')]",
  "properties": {
    "sku": "Enterprise",
    "ldapsSettings": {
      "ldaps": "Enabled"
    },
    "domainSecuritySettings": {
      "ntlmV1": "Disabled",
      "tlsV1": "Disabled",
      "kerberosRc4Encryption": "Disabled"
    },
    "replicaSets": [
      {
        "subnetId": "[parameters('primarySubnetId')]",
        "location": "[parameters('location')]"
      },
      {
        "subnetId": "[parameters('secondarySubnetId')]",
        "location": "[parameters('secondaryLocation')]"
      }
    ]
  }
}