What should you include in the identity management strategy to support the planned changes?

The most effective and recommended strategy for providing authentication to domain-joined IaaS workloads migrated to Azure is to extend the existing on-premises Active Directory. Deploying replica domain controllers for the corp.fabrikam.com domain as virtual machines in Azure virtual networks places authentication services close to the applications. This design reduces authentication latency, improves performance, and increases resilience by eliminating the dependency on the WAN connection to on-premises domain controllers for Azure-based resources. This is a standard hybrid identity reference architecture.

A. Moving all domain controllers to Azure is a high-risk strategy that makes on-premises resources entirely dependent on the WAN connection for authentication, creating a critical point of failure.

C. Deploying a new Azure AD tenant would create identity fragmentation and unnecessary administrative complexity, and it does not solve the requirement for AD DS authentication for IaaS VMs.

D. This option proposes deploying domain controllers for a different forest (rd.fabrikam.com), which would not serve the authentication needs of resources belonging to the corp.fabrikam.com forest.

1. Microsoft Learn

Azure Architecture Center. "Extend an on-premises Active Directory domain to Azure." This reference architecture explicitly states

"Deploy AD DS servers in an Azure virtual network. To implement this

run domain controllers as VMs in Azure." It details this pattern as the solution for applications running on Azure VMs that need to access domain services.

Source: https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/identity/adds-extend-domain

Solution details section.

2. Microsoft Learn

Cloud Adoption Framework. "Azure identity and access management design area." In the section on design recommendations for identity and access management

it advises

"For IaaS-based workloads that require Active Directory Domain Services

extend your on-premises Active Directory Domain Services into Azure virtual networks by deploying domain controllers as virtual machines."

Source: https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access

Design recommendations section.

3. Microsoft Learn

Windows Server Documentation. "Active Directory Domain Services (AD DS) on Azure." This document outlines deployment options and recommends

"You can deploy replica domain controllers of your on-premises forest/domain on Azure IaaS inside an Azure Virtual Network."

Source: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/introduction/ad-ds-on-azure

"Deploy AD DS on Azure IaaS" section.