Managing the Internet domains for your directory

Managing the Internet domains for your directory

This is the default domain. When you create a new user, the user’s sign-in name and email address are assigned to this default domain.

You can off course add one or more customs Internet domains to a directory rather than retaining the onmicrosoft.com domain, and then assign users to sign in with any of the validated domains.

You can register multiple Internet domain names for a directory, for example fabrikam.com, in addition to the initial default domain, for example corpfabrikam.onmicrosoft.com. A directory allows you to register an Internet domain only after you proves that your organization owns the DNS namespace in the public Internet DNS. As of this writing, you can host up to 600 registered Internet domains in your directory, each represented by a different DNS namespace.

A domain can then be either a cloud (standard) domain or a federated (single sign-on) domain, meaning that all users on a domain MUST use the same identity system: either cloud identity or federated identity as previously covered.

For example, you could have one group of users that only needs a cloud identity because they don’t have an on-premises account and/or access on-premises systems, and another group of users who have an on-premises account and/or use cloud applications and on-premises systems. You would use add two domains to the directory tenant, such as contractors.fabrikam.com and ftes.fabrikam.com, and only set up the federation for one of them.

A domain can be converted from cloud to federated to sustain federated identities in lieu of cloud identities, or from federated to cloud.

Note For more information, see the Microsoft TechNet articles Add your domain⁸³.

To register an Internet domain, proceed with the following steps:

1. 
   Open a browsing session, navigate to the Azure management portal, and sign in as the administrator of the directory to configure.
   
2. 
   Click ACTIVE DIRECTORY, and then click the name of the organization’s directory for which an Internet domain should be added.
   

3. 
   Click ADD A CUSTOM DOMAIN if no Internet domain have been added so far or ADD at the tray of the bottom. An ADD DOMAIN dialog brings up.
   

4. 
   On the Specify a domain name page, type the domain name that you want to add. I plan to configure this domain for single sign-on with my local Active Directory enabled to prepare the configuration as a federated Internet domain. For the moment, do not check this option.
   
5. 
   Click add.
   

6. 
   Click the arrow icon at the bottom right.
   

7. 
   Follow the steps on the page to verify the Internet domain name you have added belongs to you.
   

8. 
   Once the TXT record is added to your DNS domain registrar, click verify to complete the registration.
   
9. 
   If the domain is successfully verified, click the check mark at the bottom right to close the dialog.
   

Like for the above steps 4 to 6, the New-MsolDomain cmdlet enables to add a standard (cloud) Internet domain. After running this command, you have to prove that your organization owns the DNS namespace in the public Internet DNS.

For that purpose, and in order to verify the DNS domain name, you need to use the Get-MsolDomainVerificationDns cmdlet in order to get the DNS record information required to create for the new cloud domain.

Once the given TXT record is added at your DNS domain registrar, you finally prove your control of the DNS namespace by running the Confirm-MsolDomain cmdlet.

Likewise, you can use the New-MsolFederatedDomain cmdlet to create of custom federated (single sign-on) domain in your directory. Finally, the Set-MsolDomainAuthentication cmdlet enables to convert a standard domain into a single-sign on domain.

When a domain is federated, you will no longer have the option to add the domain suffix to the user accounts. The users will need to be created on-premises in order for them to have the federated domain name available to them. You can still create accounts directly in the cloud, but they cannot have the federated domain name assigned to them unless they are created on-premises. Remember the directory integration scenario Directory synchronization with single sign-on earlier in this document.

Moreover, and as expected, when the user signs-in to Azure AD with his federated account, he’s invited to authenticate on the on-premises identity infrastructure. If single sign-on is correctly set up, you will indeed notice that the user cannot even type a password in the login Web page of the sign-in service of Azure AD. Password will be indeed shaded. The user will be instead smoothly redirected to the declared on-premises identity provider.