title: Management concepts for Microsoft Entra Domain Services | Microsoft Docs
description: Learn about how to administer a Microsoft Entra Domain Services managed domain and the behavior of user accounts and passwords
ms.topic: concept-article
ms.date: 01/21/2025
---
# Management concepts for user accounts, passwords, and administration in Microsoft Entra Domain Services
## Domain management
A managed domain is a DNS namespace and matching directory. In a managed domain, the domain controllers (DCs) that contain all the resources like users and groups, credentials, and policies are part of the managed service. For redundancy, two DCs are created as part of a managed domain. You can't sign in to these DCs to perform management tasks. Instead, you create a management VM that's joined to the managed domain, then install your regular AD DS management tools. You can use the Active Directory Administrative Center or Microsoft Management Console (MMC) snap-ins like DNS or Group Policy objects, for example.
## User account creation
User accounts can be created in a managed domain in multiple ways. Most user accounts are synchronized in from Microsoft Entra ID, which can also include user account synchronized from an on-premises AD DS environment. You can also manually create accounts directly in the managed domain. Some features, like initial password synchronization or password policy, behave differently depending on how and where user accounts are created.
* The user account can be synchronized in from Microsoft Entra ID. This includes cloud-only user accounts created directly in Microsoft Entra ID, and hybrid user accounts synchronized from an on-premises AD DS environment using Microsoft Entra Connect.
* The majority of user accounts in a managed domain are created through the synchronization process from Microsoft Entra ID.
* The user account can be manually created in a managed domain, and doesn't exist in Microsoft Entra ID.
* If you need to create service accounts for applications that only run in the managed domain, you can manually create them in the managed domain. As synchronization is one way from Microsoft Entra ID, user accounts created in the managed domain aren't synchronized back to Microsoft Entra ID.
title: Management concepts for Microsoft Entra Domain Services | Microsoft Docs
description: Learn about how to administer a Microsoft Entra Domain Services managed domain and the behavior of user accounts and passwords
ms.topic: concept-article
ms.date: 06/22/2026
ai-usage: ai-assisted
ms.custom: msecd-doc-authoring-1013
---
# Management concepts for user accounts, passwords, and administration in Microsoft Entra Domain Services
## Domain management
A managed domain is a DNS namespace and matching directory. In a managed domain, the domain controllers (DCs) that contain all the resources like users and groups, credentials, and policies are part of the managed service. For redundancy, two DCs are created as part of a managed domain. You can't sign in to these DCs to perform management tasks. Instead, you create a management virtual machine (VM) that's joined to the managed domain, then install your regular AD DS management tools. You can use the Active Directory Administrative Center or Microsoft Management Console (MMC) snap-ins like DNS or Group Policy objects, for example.
## User account creation
User accounts can be created in a managed domain in multiple ways. Most user accounts are synchronized in from Microsoft Entra ID, which can also include user account synchronized from an on-premises AD DS environment. You can also manually create accounts directly in the managed domain. Some features, like initial password synchronization or password policy, behave differently depending on how and where user accounts are created.
* The user account can be synchronized in from Microsoft Entra ID. It can be created directly in Microsoft Entra ID synchronized from an on-premises AD DS environment by using Microsoft Entra Connect.
* The user account can be manually created in a managed domain, and not exist in Microsoft Entra ID. If you need to create service accounts for applications that only run in the managed domain, you can manually create them in the managed domain. Synchronization is only one-way from Microsoft Entra ID, so user accounts that you create in the managed domain aren't synchronized back to Microsoft Entra ID.