Review password-hash prerequisites before using Entra Domain Services for RDS

Source facts

Microsoft documents using Entra Domain Services in an RDS deployment in place of Windows Server Active Directory. Its prerequisites require the necessary password hashes to be available in Microsoft Entra ID. For identities originating on premises, the source calls for permitting hash synchronization and storage, and notes password-reset requirements after the configuration change. Microsoft Learn.

Applicability

Identify where the intended user identities originate and have the identity owner assess the required password-hash handling. Review the linked current Entra Domain Services guidance for the actual tenant and account population. Treat this as an identity-design decision, not simply an RDS installation option.

DSE recommendation

Document the proposed identity path, the organizational decision on synchronized password hashes, and the affected user population. Assign responsibility for any required password changes and user communications. Pilot with a small authorized set before placing a production collection on the managed domain. Keep the directory prerequisite assessment separate from the RDS application and capacity plan.

Verification

Verify that pilot identities can perform the intended domain and RDS authentication after the required preparation. Include an account that has not completed the prerequisite steps and document its outcome. Confirm user communications and support ownership before expanding the deployment. Record identity failures separately from collection or application failures.

Official references

Microsoft Learn: Microsoft Entra Domain Services and Remote Desktop Services. Source reviewed September 8, 2026.