GPOs in Azure AD DS
Azure AD DS manages Group Policy in much the same way as AD to manage settings for the user and computer objects, but with restrictions on what settings can be accessed and configured in the managed domain.
When Azure AD DS is implemented in an Azure AD tenant, two built-in GPOs are created for managing the configuration of users and computers. These are as follows:
- AADDC Users GPO
- AADDC Computers GPO
These are shown in the following screenshot:
Figure 3.9 – Default Azure AD DS GPOs
You can create custom GPOs if you need additional settings not available in these GPOs. These can only be linked to OUs, and you can create additional custom OUs as required to meet your needs. For Group Policy administration privileges in the managed domain, you need to be a member of the AAD DC administrators group.
In a hybrid identity environment where both AD DS and Azure AD DS are utilized, group policies from the AD DS DCs...
