Skip to content

Is AWS Managed Microsoft AD (Hybrid Edition) compatible with Microsoft Entra ID Domain Services?

1

https://docs.aws.amazon.com/directoryservice/latest/admin-guide/aws-hybrid-directory.html states that AWS Managed Microsoft AD (Hybrid Edition) works with on-premises Active Directory However, based on this https://docs.aws.amazon.com/transfer/latest/userguide/azure-sftp.html, it seems that AD Connector does support Entra ID Domain services. We are currently using Microsoft Entra ID Domain Services (formerly Azure AD DS), not traditional on-premises AD. We need a solution to allow users to authenticate to EC2 Windows instances and AWS Managed RDS SQL Server using a single set of Microsoft Entra ID credentials. Since AD Connector doesn't support RDS SQL Server, we are looking at AWS Managed Microsoft AD (Hybrid Edition) Can you clarify if AWS Managed Microsoft AD (Hybrid Edition) is compatible with, and can integrate with, Microsoft Entra ID Domain Services for hybrid identity scenarios?

asked 9 months ago368 views

3 Answers
1

No, I do not believe this use case is support because of a limitation with Microsoft Entra ID Domain Services. Microsoft would have release their own Hybrid version of their service before this would be possible.

From Microsoft's Entra Domain Services FAQ:

Can I add domain controllers to a Microsoft Entra Domain Services managed domain?
No. The domain provided by Microsoft Entra Domain Services is a managed domain. You don't need to provision, configure, or otherwise manage domain controllers for this domain. These management activities are provided as a service by Microsoft. Therefore, you can't add more domain controllers (read-write or read-only) for the managed domain.

https://learn.microsoft.com/en-us/entra/identity/domain-services/faqs#can-i-add-domain-controllers-to-a-microsoft-entra-domain-services-managed-domain-

AWS

answered 9 months ago

0

Based on the available information, AWS Managed Microsoft AD (Hybrid Edition) is designed to connect with self-managed Microsoft Active Directory environments, not specifically with Microsoft Entra ID Domain Services.

For integrating with Microsoft Entra ID (formerly Azure AD), AWS offers different solutions. AD Connector can be used with Entra ID Domain Services for certain use cases like SFTP transfers through AWS Transfer Family. However, AD Connector doesn't support RDS SQL Server as you noted.

For your specific requirements of authenticating to EC2 Windows instances and RDS SQL Server using Microsoft Entra ID credentials, you might need to consider a combination of services. AWS Managed Microsoft AD (Standard or Enterprise Edition) could be set up with appropriate trust relationships to your identity environment.

Another approach would be using AWS IAM Identity Center in conjunction with Microsoft Entra Connect and Active Directory Federation Services (AD FS). This setup allows synchronization of users from your directory to Microsoft Entra ID and enables federation for accessing AWS services using your existing credentials.

For your specific scenario involving Microsoft Entra ID Domain Services rather than traditional on-premises AD, you should contact AWS Support for the most current compatibility information, as the documentation doesn't explicitly confirm compatibility between AWS Managed Microsoft AD (Hybrid Edition) and Microsoft Entra ID Domain Services.
Sources
AWS integrate with AD\AAD | AWS re:Post
Using AWS Directory Service for Entra ID Domain Services - AWS Transfer Family
Understanding AWS Managed Microsoft AD (Hybrid Edition) - AWS Directory Service

answered 9 months ago

AWS
EXPERT

reviewed 9 months ago

0

Entra ID is not the former Azure AD DS. Entra ID is the former Azure AD. The naming convention is quite confusing here.

The short answer is no. Entra ID (formerly Azure AD) is not a fully features Active Directory, it is more like a user pool for authenticating web applications using SAML. You can sync users from AWS Managed AD (including Hybrid) to an Entra ID tenant by using the Microsoft Entra Connect Sync but you cannot write-back passwords to AWS Managed AD. So you can only partially achieve you goal.

A different service is Entra Domain Services (formerly called Azure AD DS which stands for Azure Active Directory Domain Services). This is a fully featured Active Directory running on Azure cloud. Assuming there is an Entra Domain Services and network connectivity to an AWS Managed AD (for example over a VPN) you may be able to setup a trust relationship between both and then achieve your goal.

AWS
EXPERT

answered 9 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.