Microsoft Security | Microsoft Entra | Microsoft Entra ID
A cloud-based identity and access management service for securing user authentication and resource access
The AAD DC Administrators group is not a full Domain Admin / Enterprise Admin group and does not grant unrestricted rights on the managed domain or on all workloads.
In Microsoft Entra Domain Services:
- Membership in AAD DC Administrators is a special, delegated admin role. It provides:
- Administrative permissions on VMs that are domain-joined to the managed domain (the group is added to the local Administrators group on those VMs).
- Rights to perform certain delegated operations in the managed domain, such as configuring Group Policy, DNS, and creating OUs.
- The service explicitly does not expose Domain Administrator or Enterprise Administrator privileges to tenant users. Those roles are reserved by the service and are not available.
From the documentation:
- Members of AAD DC Administrators are “granted administrative permissions on VMs that are domain-joined to the managed domain” and can use Remote Desktop to those VMs, and can configure Group Policy.
- However, “Domain Administrator and Enterprise Administrator permissions on a managed domain using Domain Services” are not granted to users.
Because of this design, some operations remain restricted even for AAD DC Administrators, especially where:
- The permission is controlled by Microsoft-managed domain policies or service configuration (for example, time configuration policies, schema, DHCP authorization, etc.).
- The operation requires true Domain Admin / Enterprise Admin rights, which are not exposed in Microsoft Entra Domain Services.
So, AAD DC Administrators is a delegated admin group with specific capabilities, not a “real” Domain Admin equivalent. Tasks such as changing certain system-wide settings or installing/configuring some infrastructure components may still be blocked if they rely on privileges that Domain Services does not delegate.
References:
- Tutorial: Create and configure a Microsoft Entra Domain Services managed domain with advanced configuration options
- Frequently asked questions (FAQs) about Microsoft Entra Domain Services
- Administer Group Policy in a Microsoft Entra Domain Services managed domain
- Join an Ubuntu Linux virtual machine to a Microsoft Entra Domain Services managed domain
- Microsoft Entra Domain Services deployment and management for Azure Cloud Solution Providers