Azure Active Directory Domain Services - Question on use of AAD DC Administrators group

Question

Scenario: AADDS deployed, Azure hosted Windows servers are domain joined. Using Azure Bastion to RDP into the domain joined servers. However, it seems the only user accounts who are part of the AAD DC Administrators group can successfully RDP to the servers.

Question: Is it possible to add security groups other than AAD DC Administrators to the local administrators group on domain joined joined servers as to allow RDP access for remote administration?

TIA,

Matt

Answer 1

Once you join a machine to the AADDS domain, you can treat it like a standalone AD DS domain in regards to GPO's and login, etc..

I tested this scenario yesterday and verified that you can add both individual users and AAD groups to the local Administrators group (or any group that allows login to a server) and those users will be able to login with both RDP and via Bastion.

Answer 2

Remote access to virtual machines (VMs) that run in an Azure Active Directory Domain Services (Azure AD DS) managed domain requires a user account that's a member of the Azure AD DC administrators group in your Azure AD tenant. This is one of the prerequisites.