This chapter covers Microsoft Entra Domain Services, a managed service providing traditional domain-services capabilities in Azure. AZ-900 tests this under objective 2.5, alongside the broader Microsoft Entra ID coverage.
Jump to a section
A simple way to picture Microsoft Entra Domain Services
Some older office buildings run on traditional systems — a specific badge-reader technology, for instance — that a newer, cloud-based access system doesn't directly replace. Rather than ripping out and rebuilding those older systems, you could host an equivalent traditional system elsewhere, managed for you, so old and new can work together. Microsoft Entra Domain Services plays that role for identity: it provides traditional, domain-join-style identity services (compatible with older technology expecting that model) without an organization having to run and maintain the underlying domain controllers themselves.
What Entra Domain Services provides
Microsoft Entra Domain Services provides managed domain services — capabilities like domain join, group policy, and traditional authentication protocols — compatible with legacy applications and systems that expect a traditional, on-premises-style directory, without the organization needing to deploy and maintain its own domain controllers.
Why this is different from Microsoft Entra ID alone
Microsoft Entra ID (covered in its own chapter) is a modern, cloud-based identity service. Some older applications and systems, however, are built to expect traditional domain-services capabilities that Entra ID alone doesn't provide directly. Entra Domain Services bridges that gap, offering those traditional capabilities as a managed service.
Managed, not self-hosted
Because it's a managed service, Microsoft handles the underlying domain controller infrastructure — the organization doesn't need to deploy, patch, or maintain domain controllers themselves, similar in spirit to how other managed Azure services reduce infrastructure management burden.
When it's relevant
This service is most relevant for organizations migrating legacy applications to Azure that specifically depend on traditional domain-services capabilities, rather than for organizations building entirely new, cloud-native applications that can rely on Microsoft Entra ID directly.
Identify legacy compatibility needs
Determine whether an application or system specifically requires traditional domain-services capabilities.
Enable Entra Domain Services
The managed domain-services capability is enabled for the organization's Azure environment.
Connect legacy systems
Legacy applications that expect traditional domain services can then use this managed capability instead of requiring self-hosted domain controllers.
An organization migrating a legacy application to Azure discovers the application specifically depends on traditional domain-join capabilities. Rather than deploying and maintaining their own domain controllers in Azure, they use Microsoft Entra Domain Services to provide that capability as a managed service.
Objective 2.5 expects recognition of Microsoft Entra Domain Services as a managed service providing traditional domain-services capabilities, distinct from Microsoft Entra ID's modern, cloud-native identity model.
A common wrong answer is assuming Microsoft Entra ID alone covers every identity scenario — Entra Domain Services specifically exists to bridge legacy compatibility needs that Entra ID alone doesn't address.
Stable terms: Microsoft Entra Domain Services. Memory trick: Entra Domain Services = traditional domain-services capabilities, managed for you, for legacy compatibility — not the same as Entra ID's modern cloud identity model.
Microsoft Entra Domain Services provides managed, traditional domain-services capabilities in Azure.
It bridges compatibility gaps for legacy applications that expect a traditional directory, which Entra ID alone doesn't provide.
As a managed service, Microsoft handles the underlying domain controller infrastructure.
These come up on the exam all the time. Here's how to tell them apart.
Microsoft Entra ID
Modern, cloud-native identity service
Suited to new, cloud-native applications
Microsoft Entra Domain Services
Managed, traditional domain-services capability
Suited to legacy applications expecting a traditional directory
Mistake
Microsoft Entra ID and Microsoft Entra Domain Services are the same service.
Correct
Entra ID is a modern, cloud-based identity service; Entra Domain Services specifically provides managed, traditional domain-services capabilities for legacy compatibility — they serve different purposes.
It's a managed service providing traditional domain-services capabilities — like domain join and group policy — compatible with legacy applications, without the organization needing to deploy and maintain its own domain controllers.
Some legacy applications and systems specifically expect traditional domain-services capabilities that Entra ID's modern, cloud-native model doesn't directly provide. Entra Domain Services bridges that gap for those specific compatibility needs.
You've just covered Microsoft Entra Domain Services — now see how well it sticks with free AZ-900 practice questions. Full explanations included, no account needed.
Done with this chapter?