Mastering Active Directory

Create an AAD DC administrator group

Since the Azure AD Domain Services is a managed service, you will not get Domain Admin or Enterprise Admin privileges to the AD instance. But we are allowed to create a group called AAD DC administrators, and then all the members of this group will be granted administrator privileges to the domain-joined servers (this group will be added to the administrators group of the domain-join servers):

1. Click on the relevant Azure AD instance.
2. Navigate to the GROUPS link and then the ADD A GROUP option:

3. Then in the next window, type the group name AAD DC Administrators and select the type Security, and then click ...