Edit

Share via

Create an Organizational Unit (OU) in a Microsoft Entra Domain Services managed domain

  • Article

Organizational units (OUs) in an Active Directory Domain Services (AD DS) managed domain let you logically group objects such as user accounts, service accounts, or computer accounts. You can then assign administrators to specific OUs, and apply group policy to enforce targeted configuration settings.

Domain Services managed domains include the following two built-in OUs:

  • AADDC Computers - contains computer objects for all computers that are joined to the managed domain.
  • AADDC Users - includes users and groups synchronized in from the Microsoft Entra tenant.

As you create and run workloads that use Domain Services, you may need to create service accounts for applications to authenticate themselves. To organize these service accounts, you often create a custom OU in the managed domain and then create service accounts within that OU.

In a hybrid environment, OUs created in an on-premises AD DS environment aren't synchronized to the managed domain. Managed domains use a flat OU structure. All user accounts and groups are stored in the AADDC Users container, despite being synchronized from different on-premises domains or forests, even if you've configured a hierarchical OU structure there.

This article shows you how to create an OU in your managed domain.

Before you begin

To complete this article, you need the following resources and privileges:

Custom OU considerations and limitations

When you create custom OUs in a managed domain, you gain additional management flexibility for user management and applying group policy. Compared to an on-premises AD DS environment, there are some limitations and considerations when creating and managing a custom OU structure in a managed domain:

  • To create custom OUs, users must be a member of the AAD DC Administrators group.
  • A user that creates a custom OU is granted administrative privileges (full control) over that OU and is the resource owner.
    • By default, the AAD DC Administrators group also has full control of the custom OU.
  • A default OU for AADDC Users is created that contains all the synchronized user accounts from your Microsoft Entra tenant.
    • You can't move users or groups from the AADDC Users OU to custom OUs that you create. Only user accounts or resources created in the managed domain can be moved into custom OUs.
  • User accounts, groups, service accounts, and computer objects that you create under custom OUs aren't available in your Microsoft Entra tenant.
    • These objects don't show up using the Microsoft Graph API or in the Microsoft Entra UI; they're only available in your managed domain.

Create a custom OU

To create a custom OU, you use the Active Directory Administrative Tools from a domain-joined VM. The Active Directory Administrative Center lets you view, edit, and create resources in a managed domain, including OUs.

Note

To create a custom OU in a managed domain, you must be signed in to a user account that's a member of the AAD DC Administrators group.

  1. Sign in to your management VM. For steps on how to connect using the Microsoft Entra admin center, see Connect to a Windows Server VM.

  2. From the Start screen, select Administrative Tools. A list of available management tools is shown that were installed in the tutorial to create a management VM.

  3. To create and manage OUs, select Active Directory Administrative Center from the list of administrative tools.

  4. In the left pane, choose your managed domain, such as aaddscontoso.com. A list of existing OUs and resources is shown:

    Select your managed domain in the Active Directory Administrative Center

  5. The Tasks pane is shown on the right side of the Active Directory Administrative Center. Under the domain, such as aaddscontoso.com, select New > Organizational Unit.

    Select the option to create a new OU in the Active Directory Administrative Center

  6. In the Create Organizational Unit dialog, specify a Name for the new OU, such as MyCustomOu. Provide a short description for the OU, such as Custom OU for service accounts. If desired, you can also set the Managed By field for the OU. To create the custom OU, select OK.

    Create a custom OU from the Active Directory Administrative Center

  7. Back in the Active Directory Administrative Center, the custom OU is now listed and is available for use:

    Custom OU available for use in the Active Directory Administrative Center

Next steps

For more information on using the administrative tools or creating and using service accounts, see the following articles: