Active Directory without a domain controller?

The key question was, in smaller companies, a local domain controller is still necessary if virtually all services from the cloud are used.

The initial situation

Small Businesses with their own Active Directory

We found a small company with 10 workstations, for which an Active Directory for user management is operated. Microsoft 365 E3 is used, and no other services or applications are available on the local network except for one network printer.

The task

User management in Azure AD without local DC

The user should log on to his computer and get access to all applications and services shared with him without having to log in again anywhere. This means that the computer must be connected to Azure AD in order to use all the possibilities there.

The solution

Register Windows 10 device in Azure AD

The solution should be simple, enroll device in Azure Active Directory, connect an organization account, and it should work.

The configuration

Azure AD Join on Windows 10

To include a Windows 10 device in Azure AD on Windows Welcome Site:

When you turn on the new device and start the setup process, you should see the Preparation message. Follow the instructions to set up your device.
First, adjust the region and language. Then accept the Microsoft software license terms.

3. Select the network you want to use to connect to the Internet.

4. Click This device belongs to my organization.

5. Enter the credentials provided by your organization and click Sign in.

6. Your device determines a matching tenant in Azure AD. If you are in a federation domain, you are redirected to your local security token service (STS) server, such as Active Directory Federation Services (AD FS).

7. If you are a user in a disconnected domain, enter your credentials directly on the Azure AD hosted page.

8. You will be prompted for multifactor authentication.

9. Azure AD checks to see if you need to sign in to mobile device management.

10. Windows enregisters the device in the organization’s directory in Azure AD and mobile device management (if applicable).

11. If you…

- are a managed user, Windows redirects you to the desktop through the automatic sign-in process.
- are a federated user, you will be redirected to the Windows login screen and must enter your credentials.

Review

You can check whether a device has been included in your Azure AD instance in the Access Work or School Account dialog box. The dialog box should indicate that you are connected to the Azure AD directory.

The conclusion

Benefits and Limitations of the Solution

It’s relatively easy to register a Windows 10 device in Azure Active Directory and move user management. Now device management is missing once the device is known in Azure Active Directory. More on that later.

Active Directory without a domain controller?