Automatically Domain Join Azure Files for AD DS

[edm-ms]

It may be possible for us to automatically domain join an Azure Files storage account using a deployment script and Azure Image Builder.

We could prompt for domain credentials, and then pass parameters to the deployment script that AIB will inject into the VM. The VM can be domain joined, download the PowerShell cmdlets, run the commands, and then delete the VM.

We would likely use a service principal or potentially a managed identity attached to the VM (need to test) so that we could authenticate to Azure. This tends to be a challenging step in the deployment so if we could automate this it would be very beneficial.

[edm-ms]

Thinking more about this we don't need AIB. We can deploy any marketplace Windows VM, use the domain join extension, and then use a custom script extension to domain join the storage account.

1. Create Windows x VM
2. Assign managed identity with access to authenticate to Azure
3. Domain join VM
4. Run custom script extension to join storage account to domain
5. Delete VM

[danycontre]

Investigating available options

[danycontre]

Missing VM deletion

cc: @nataliakon

[danycontre]

@nataliakon created/tested the code to deliver this feature.

We still need to build the code to delete the VM.

[danycontre]

VM role changed to a management VM that will be used for additional workflows, no need to be deleted for now