Networking Considerations When considering extending Active Directory to Azure, there are two primary areas of networking that need some thought: Connecting on-premises domain controllers to Azure virtual machines Networking the domain controllers in Azure with the virtual networks in IaaS Connectivity to Azure Whether the domain controllers are on-premises or deployed in the Azure, there needs to be connectivity between the Azure virtual network and your on-premises network. If you want to keep domain controllers on-premises, you need an ExpressRoute connection or a Site-to-Site VPN connection to Azure. Every time a virtual machine in Azure needs to access a domain controller, it will traverse this connection over the WAN. Depending on the stability and performance of the connection, this may cause issues. You should ask the following questions: What kind of connection is available between the on-premises network and Azure? If it’s an ExpressRoute connection, you are more likely to keep the domain controllers And it’s even better if it’s an IXP connection instead of NSP. For more information about ExpressRoute, see the ExpressRoute Overview section earlier in this document. What is the cost of network traffic across the connection? If there’s a high cost associated with the connection, and you expect the virtual machines to communicate heavily with Active Directory, it would probably be more cost-effective to include the domain controllers in IaaS. How stable is the network connection with Azure? Accessing domain controllers over the WAN will not work well if the connection is unstable. Inaccessibility to Active Directory can cause many applications and services to be unusable. If you have applications with dependencies on Active Directory, you’ll want to put in a more stable connection (consider ExpressRoute) or put the domain controllers locally in the IaaS tenant. IP Addressing Virtual machines in Azure get IP addresses assigned dynamically from the virtual network that they reside in. To the operating system, this assignment occurs via DHCP. If you try to change the IP address to a static IP address, Azure will isolate the virtual machine, and it won’t be able to communicate on the network.
Networking Considerations When considering extending Active Directory to Azure, there are two primary areas of networking that need some thought: Connecting on-premises domain controllers to Azure virtual machines Networking the domain controllers in Azure with the virtual networks in IaaS Connectivity to Azure Whether the domain controllers are on-premises or deployed in the Azure, there needs to be connectivity between the Azure virtual network and your on-premises network. If you want to keep domain controllers on-premises, you need an ExpressRoute connection or a Site-to-Site VPN connection to Azure. Every time a virtual machine in Azure needs to access a domain controller, it will traverse this connection over the WAN. Depending on the stability and performance of the connection, this may cause issues. You should ask the following questions: What kind of connection is available between the on-premises network and Azure? If it’s an ExpressRoute connection, you are more likely to keep the domain controllers And it’s even better if it’s an IXP connection instead of NSP. For more information about ExpressRoute, see the ExpressRoute Overview section earlier in this document. What is the cost of network traffic across the connection? If there’s a high cost associated with the connection, and you expect the virtual machines to communicate heavily with Active Directory, it would probably be more cost-effective to include the domain controllers in IaaS. How stable is the network connection with Azure? Accessing domain controllers over the WAN will not work well if the connection is unstable. Inaccessibility to Active Directory can cause many applications and services to be unusable. If you have applications with dependencies on Active Directory, you’ll want to put in a more stable connection (consider ExpressRoute) or put the domain controllers locally in the IaaS tenant. IP Addressing Virtual machines in Azure get IP addresses assigned dynamically from the virtual network that they reside in. To the operating system, this assignment occurs via DHCP. If you try to change the IP address to a static IP address, Azure will isolate the virtual machine, and it won’t be able to communicate on the network.
Hybrid%20Cloud%20-%20Azure%20Reference%20Architecture%20-%20Partner.docx