Migrated existing VM (AzureADJoined and DomainJoined) with latest image and want to join new VM to redmond domain

Question

Migrated existing VM (AzureADJoined and DomainJoined) with latest image and want to join new VM to redmond domain

Harveer Singh 0 Microsoft External Staff

VM to VMSS Flex migration with auto OS upgrade enabled

Migrated a VM (windows server 2016) AzureAdJoined and DomainJoined (redmond.crop.microsoft.com and corp.microsoft.com) to VM (windows server 2025) and attach to VMSS. So, created new VM in same VNet and subnet as existing VM.

But for this VM AzureAdJoined is Yes and DomainJoined is NO. So, need to connect to same domains (redmond.crop.microsoft.com and corp.microsoft.com).

SUNOJ KUMAR YELURU 18,736 Reputation points MVP Volunteer Moderator

2026-07-25T04:56:21.85+00:00
Hello @Harveer Singh,

Thank you for using Q & A forum.

If your new VM is Azure AD joined but not domain joined, and you need it to connect to the domains redmond.crop.microsoft.com and corp.microsoft.com, you will need to ensure that the VM is properly configured to join the domain. Here are the steps to do so:

DNS Configuration: Make sure that the new VM has the correct DNS settings to locate the on-premises domain controllers. Go to the Azure Portal, select the Virtual Network where the VM is deployed, and update the DNS settings to include the IP addresses of the Redmond domain DNS servers. This is essential for the VM to resolve domain names correctly.

Restart the VM: After updating the DNS settings, restart the new VM to apply the changes.

Validate DNS Resolution: Log in to the new VM and run ipconfig /all to confirm that the DNS servers point to the Redmond DNS. Ensure that the VM can resolve the domain controller addresses.

Domain Join: Use a domain user account with join permissions to join the new VM to the Redmond domain. Ensure that the necessary connectivity to the domain controller ports (such as 88, 389, 445, and 464) is available, as Active Directory requires DNS to locate domain controllers.

Post-Migration Considerations: If you encounter issues during the domain join process, check for any known requirements or configurations specific to Azure domain-joined VMs, as these can impact the ability to join the domain.

If this answers your query, do click Accept Answer and Up-Vote for the same. And, if you have any further query do let us know.
kagiyama yutaka 5,330 Reputation points

2026-07-25T05:51:25.6933333+00:00

Could you add a bit more detail about how the new Server 2025 VM was created and attached to the VMSS?

To understand the current join state, I need to know whether the image was generalized before deployment, whether the VMSS applies any domain‑join logic, and what DNS servers the VNet is using.

2 answers

Your answer

SUNOJ KUMAR YELURU 18,736 Reputation points MVP Volunteer Moderator

2026-07-25T04:56:21.85+00:00

Hello @Harveer Singh,

Thank you for using Q & A forum.

If your new VM is Azure AD joined but not domain joined, and you need it to connect to the domains redmond.crop.microsoft.com and corp.microsoft.com, you will need to ensure that the VM is properly configured to join the domain. Here are the steps to do so:

DNS Configuration: Make sure that the new VM has the correct DNS settings to locate the on-premises domain controllers. Go to the Azure Portal, select the Virtual Network where the VM is deployed, and update the DNS settings to include the IP addresses of the Redmond domain DNS servers. This is essential for the VM to resolve domain names correctly.

Restart the VM: After updating the DNS settings, restart the new VM to apply the changes.

Validate DNS Resolution: Log in to the new VM and run ipconfig /all to confirm that the DNS servers point to the Redmond DNS. Ensure that the VM can resolve the domain controller addresses.

Domain Join: Use a domain user account with join permissions to join the new VM to the Redmond domain. Ensure that the necessary connectivity to the domain controller ports (such as 88, 389, 445, and 464) is available, as Active Directory requires DNS to locate domain controllers.

Post-Migration Considerations: If you encounter issues during the domain join process, check for any known requirements or configurations specific to Azure domain-joined VMs, as these can impact the ability to join the domain.

If this answers your query, do click Accept Answer and Up-Vote for the same. And, if you have any further query do let us know.
kagiyama yutaka 5,330 Reputation points

2026-07-25T05:51:25.6933333+00:00

Could you add a bit more detail about how the new Server 2025 VM was created and attached to the VMSS?

To understand the current join state, I need to know whether the image was generalized before deployment, whether the VMSS applies any domain‑join logic, and what DNS servers the VNet is using.

Answer 1

Hi Harveer Singh,

Based on the error messages provided, there appear to be two separate blockers preventing the domain join operation:

The new Windows Server 2025 VM is already Microsoft Entra ID (Azure AD) joined. Windows is preventing a direct Active Directory domain join while the device remains in its current Entra ID joined state. Depending on your organization's identity configuration, the device may need to be disconnected from Entra ID first or configured as part of a supported hybrid identity scenario.

The domain join account being used does not currently have sufficient permissions to create additional computer accounts in the domain. The error indicates the account has reached the allowed computer account creation limit. Your Active Directory administrator may need to pre-create the computer account, delegate appropriate permissions, or adjust the applicable Active Directory quota settings.

In addition, please verify that:

The VM is using the correct domain DNS servers.
Network connectivity to the domain controllers is available.
The correct OU and domain join account are being used.

Once the identity configuration and Active Directory permissions are addressed, the domain join operation should be able to proceed successfully.

Please do let us know If you have any further queries.

Answer 2

Allan Solomon Mejia 7,915

Hello Harveer,

The new Windows Server 2025 VM won't automatically become domain-joined just because it's in the same VNet and subnet. Azure AD Join and Active Directory Domain Join are separate processes.

Before joining the new VM to redmond.corp.microsoft.com or corp.microsoft.com, verify:

The VM is using the correct AD DNS servers (not Azure default DNS).

Network connectivity to the domain controllers is working (required ports are open).

Time is synchronized with the domain.

The computer account has permission to join the domain.

Once those prerequisites are met, you can join the VM through System Properties or PowerShell (Add-Computer), then restart the server. If Azure AD Join is also required, you can keep the device in a hybrid state after the AD domain join, depending on your organization's hybrid identity configuration.

If the VM was created from a generalized image or migrated into a VMSS, it may also be worth confirming whether there are any VMSS provisioning extensions or policies that are preventing or overriding the domain join.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Harveer Singh 0 Reputation points Microsoft External Staff

2026-07-29T14:40:22.4233333+00:00

Hi @Allan Solomon Mejia , possibly I don't have access to join this domain. I'm getting below exceptions:
Allan Solomon Mejia 7,915 Reputation points

2026-07-29T17:50:07.56+00:00

Hello @Harveer Singh

Thanks for sharing the screenshots, they actually show two different blockers.

The first error indicates the VM is already Microsoft Entra ID (Azure AD) joined, so Windows won't allow a direct join to an on-premises Active Directory domain until it's disconnected from Entra ID (or configured using your organization's hybrid identity approach).

After that, the second error indicates an Active Directory permission issue. The account you're using has exceeded the number of computer accounts it is allowed to create in the domain (controlled by the ms-DS-MachineAccountQuota setting). At this point, your AD administrator should either pre-create the computer account, delegate the required permissions, or remove/reset an existing computer object before retrying the join.

I'd also verify that you're joining the correct OU and using a domain account with sufficient permissions. Once those prerequisites are met, the domain join should complete successfully.

Please "Accept the Answer" if this information helped you. This will help us and others in the community as well.
Allan Solomon Mejia 7,915 Reputation points

2026-08-08T00:31:18.5766667+00:00

Hello @Harveer Singh

Please let me know if you need further assistance, otherwise please "Accept the Answer". Thank you.