How to fix error AADDS600 for AADDS

Alert AADDS600 indicates there are unresolved health alerts that are blocking Microsoft from managing and patching the domain controllers in the managed domain. Even if sign-ins still work, the service is in a degraded and unsupported state until the underlying alerts are fixed.

To address this:

1. Open the managed domain’s health blade
   • Go to the Microsoft Entra admin center and open the Microsoft Entra Domain Services resource.
   • Check Domain Services health for any active alerts. AADDS600 is a summary alert; there will be one or more underlying alerts (for example, NSG, UDR, or other configuration issues) listed with their own IDs.
2. Resolve each underlying health alert
   • For each alert ID shown, follow the specific remediation steps in its description. For network-related alerts (such as replication being blocked):
     • Verify NSGs on the subnet and NICs of the managed domain controllers allow all required ports and protocols between the domain controllers, and from the Azure platform, as documented in the NSG guidance.
     • Verify no user-defined routes (UDRs) are blocking or altering the default 0.0.0.0 route in a way that prevents communication between domain controllers or from Azure service tags to the managed domain subnet. UDRs are not required for Domain Services and misconfiguring them puts the domain in an unsupported state.
     • Ensure inbound traffic from the Azure service tag IP ranges used by Domain Services is routed to the managed domain subnet.
3. Re‑check NSG rules explicitly
   • In the Microsoft Entra admin center, search for and select Network security groups.
   • Open the NSG associated with the managed domain subnet (for example, AADDS-contoso.com-NSG).
   • On Overview, review inbound and outbound rules and compare them to the required rules list for Domain Services.
   • Remove any custom rules that block required traffic between domain controllers or from Azure platform IPs.
   • Add any missing rules using Inbound security rules / Outbound security rules → Add.
   • Blocking communication via required ports between controllers prevents replication and data synchronization and causes health and backup errors.
4. Wait for health to refresh
   • After fixing NSGs/UDRs and any other listed alerts, wait up to about six hours for the managed domain health to re-evaluate and clear AADDS600.
5. If AADDS600 persists
   • If all underlying alerts are resolved and AADDS600 still shows, or if the blocking cause cannot be identified, open an Azure support request so the Domain Services team can review the backend state and clear or further diagnose the alert.

Note: AADDS600 is time-sensitive. If unresolved for 30 days, the managed domain can be suspended, and prolonged suspension risks deletion. Ensure all health alerts are cleared as soon as possible.

References:

• Known issues: Common alerts and resolutions in Microsoft Entra Domain Services
• Known issues: Network configuration alerts in Microsoft Entra Domain Services
• Virtual network design considerations and configuration options for Microsoft Entra Domain Services
• Common errors and troubleshooting steps for Microsoft Entra Domain Services