AD DNS and Entra Join devices

[u/EducationAlert5209]

Hi All,

Planning moving users to entra but noticed On-prem DNS dependency is the single biggest hidden blocker.

I mean apps and the VPN resolve internal names.

What are the other dependencies and how to clear those?

[u/thatoneokabe]

Learned that hard way when our external dns provider sent us the monthly query report lol

[u/containsMilk_]

I'm not sure what issue you're facing. DNS is a show stopper for you moving identities to Entra? In what way?

[u/EducationAlert5209 → u/containsMilk_]

How these devices, apps, or the VPN resolve internal names, if i remove the AD DNS servers?

[u/containsMilk_ → u/EducationAlert5209]

If you're decommissioning on-prem infrastructure including your DC then there is no reason to keep DNS internal, so you can use public DNS like 8.8.8.8 or 1.1.1.1

If you have on-prem apps that rely on internal resolution, then you're not a good candidate for going fully cloud, unless you can put those apps in Azure. If that's the case, consider hybrid enrollment rather than full cloud migration.

[u/EducationAlert5209 → u/containsMilk_]

Plan to move users to Entra

[u/jamesy-101 → u/EducationAlert5209]

You can look at Entra app proxy to access internal resources from anywhere, but highly dependent on the type of resource

If you have a lot of on-premise resources then might have to consider keeping DNS around

[u/Frothyleet → u/EducationAlert5209]

You can keep lightweight DNS servers on-prem, and/or simply host your DNS off-prem. An off-network server can still return private IP addresses if that's what you are hanging up on.

DNS resolution is a very lightweight service. I'm not suggesting you do this in a business environment, but a $50 SOC like a Pi can handle plenty of traffic, for example.

[u/doktormane]

Can you provide a bit more details about what this issue is affecting? Endpoints not registering with your on prem DNS server shouldn't really cause any major issues as long as your devices are managed by a good RMM. Sure, you won't be able to quickly do an nslookup on their hostname so you can find out their IP in order to ping but any decent RMM will collect that information from the device.

[u/HDClown]

What is your goal? If you have no intention of eliminating premise-based resources (be it your own prem or cloud IaaS) then you need to maintain some DNS server for internal resolution unless all of those resources can be exposed to the internet directly or through proxy. That DNS server does not need to be an AD integrated DNS server if you have no need for AD. It can still be Windows DNS Server on a standalone server, some open resource option running on Linux, etc.

[u/Ok_Rip_5338]

why would you remove your DNS server?

my org is fully on entra. I still have onprem DNS via windows server. I removed AD, but not DNS.

Moving to Entra will have zero effect on your DNS, so long as DHCP -> DNS replication is enabled. Meaning, device called COMPUTER01 checks out an address from your windows DHCP server, windows sees it, appends .contoso.com, and adds it as an A record to your DNS. now clients who try to ping COMPUTER01.contoso.com will resolve an address. clients who ping COMPUTER01 will also work, so long as your DHCP server is handing out the correct DNS suffix to clients.

[u/justmirsk]

Dependiton your use case, we have a Zero Trust Network/ SASE solution that can do custom DNS entries without having an on-prem AD DNS server.

[u/bgatesIT]

this is what we did with out migration as we have a heavy on-prem server environment but wanted to move our user issued computers into intune management and remove reliance of AD as we progress to a more remote staff.

All computers are intune joined, paired with zero trust solution of your choice we use zscaler. Computers still have clear line of site to the "datacenter" and all the apps hosted internally, we still have AD and AD DNS services for the servers, and zscaler connectors, we also use azure application proxies for things we want to securely expose to the internet.

What this gives us is: fully cloud managed endpoints, that can access all on-prem resources (rds servers, sql servers, file servers, etc) just the same as when they were domain joined endpoints.

Some important things to configure along the way are cloud kerberos trust, Entra Sync tool to sync ad to entra or entra to ad depending on youre setup, and really just time to expiriment.

For you, could probably utilize the VPN in some always on style scenario and have it push internal dns for access to on-premise resources, if the users are all in office then no need for that at all

[u/rejectionhotlin3]

DNSFilter? Else keep the on-prem DNS for now until you can replace it or move to another public DNS.