Try to create Microsoft Domain Service and the domain in failed state

Hello Tech Impact

Thank you for reaching out to Microsoft Q&A.

The error you’re seeing:

TLS 1.0 or 1.1 is currently deprecated. You are required to use TLS 1.2.

It means the request to create Microsoft Entra Domain Services (AADDS) is failing because the API call or environment is negotiating an older TLS version, the request is being made with TLS 1.0/1.1, which Azure no longer supports.

Why This Happens

Azure services require TLS 1.2 for all REST API calls.

If your Azure Cloud Shell or custom script uses a library or runtime that defaults to TLS 1.0/1.1, the request will fail.

This is enforced at the management endpoint (https://management.azure.com).

Below are the steps to Fix It: -

1.) Ensure TLS 1.2 is enabled in your environment

For Azure Cloud Shell, TLS 1.2 is usually enabled by default. If you’re running from a custom container or VM, verify:

curl -v https://management.azure.com --tlsv1.2

If this fails, update your OpenSSL or runtime.

2.) Update your client libraries

If using az CLI, make sure it’s the latest version:

az upgrade

• If you’re running this from Azure Cloud Bash, TLS should already be fine. The error suggests the API call might be using an older dependency or the az CLI is outdated.
• Double-check your network security policies—some proxies downgrade TLS.

Approach Using curl

TOKEN=$(az account get-access-token --resource https://management.azure.com --query accessToken -o tsv)

cat > adds.json <<'JSON'

{

"location": "East US",

"properties": {

"domainName": "contoso.com",

"sku": "Enterprise",

"filteredSync": false,

"notificationSettings": {

"additionalRecipients": [],

"notifyGlobalAdmins": true,

"notifyDcAdmins": true

},

"ldapsSettings": {

"ldaps": "Disabled"

},

"resourceForestSettings": {

"settingsType": "Default"

}

}

}

JSON

curl --tlsv1.2 -X PUT \

-H "Authorization: Bearer $TOKEN" \

-H "Content-Type: application/json" \

--data @adds.json \

Replace:

• <SUBSCRIPTION_ID> with your subscription ID.
• <RESOURCE_GROUP> with your resource group name.
• <DOMAIN_SERVICE_NAME> with the name for the AADDS instance.
• contoso.com with your actual domain name.

Please let us know if the above steps help you

Hi There I was switching from Bash to using Azure CLI to fix this but same problem still appear even I using the powershell on Azure instead of the local one on my computer.

Hello @Tech Impact,

Please try running the following PowerShell commands to disable TLSv1 in your Microsoft Entra Domain Services environment:

Install-Module -Name Az.ADDomainServices
Connect-AzAccount -Subscription aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e
$domainService = Get-AzADDomainService
Update-AzADDomainService -Name $domainService.Name -ResourceGroupName $domainService.ResourceGroupName -DomainSecuritySettingTlsV1 Disabled

This command may take about 10 minutes to complete as domain security updates are enforced.

You can refer to the official documentation below for more details on TLS enforcement and management in Entra Domain Services:

Identify applications that use deprecated TLS versions

Could you please share the documentation or REST API reference you are following to create Microsoft Entra Domain Services?

Also, have you tried creating the Entra Domain Services instance directly from the Azure Portal?

If yes, please share the exact error message or behavior you are encountering so we can investigate further.