解决现有 Azure Active Directory 域服务托管域的目录不匹配错误Resolve mismatched directory errors for existing Azure Active Directory Domain Services managed domains

如果 Azure Active Directory 域服务 (Azure AD DS) 托管域显示“租户不匹配”错误,如果不解决,就无法管理托管域。If an Azure Active Directory Domain Services (Azure AD DS) managed domain shows a mismatched tenant error, you can't administer the managed domain until resolved. 如果将基础 Azure 虚拟网络移动到其他 Azure Active 目录,则会发生此错误。This error occurs if the underlying Azure virtual network is moved to a different Azure AD directory.

本文介绍错误发生的原因以及其解决方法。This article explains why the error occurs and how to resolve it.

导致此错误的原因是什么?What causes this error?

当 Azure AD DS 托管域和虚拟网络属于两个不同的 Azure AD 租户时,会发生目录不匹配错误。A mismatched directory error happens when an Azure AD DS managed domain and virtual network belong to two different Azure AD tenants. 例如,你可能有一个名为 aaddscontoso.com 的托管域,该域在 Contoso 的 Azure AD 租户中运行。For example, you may have a managed domain called aaddscontoso.com that runs in Contoso's Azure AD tenant. 但是,托管域的 Azure 虚拟网络是 Fabrikam Azure AD 租户的一部分。However, the Azure virtual network for managed domain is part of the Fabrikam Azure AD tenant.

Azure 使用基于角色的访问控制 (RBAC) 来限制对资源的访问。Azure uses role-based access control (RBAC) to limit access to resources. 在 Azure AD 租户中启用 Azure AD DS 时,凭据哈希将同步到托管域。When you enable Azure AD DS in an Azure AD tenant, credential hashes are synchronized to the managed domain. 此操作要求你是 Azure AD 目录的租户管理员,并且必须控制对凭据的访问。This operation requires you to be a tenant admin for the Azure AD directory, and access to the credentials must be controlled.

要将资源部署到 Azure 虚拟网络并控制流量,必须对你将托管域部署到的虚拟网络具有管理权限。To deploy resources to an Azure virtual network and control traffic, you must have administrative privileges on the virtual network in which you deploy the managed domain.

若要使 RBAC 一致地工作并安全访问 Azure AD DS 使用的所有资源,托管域和虚拟网络必须属于同一 Azure AD 租户。For RBAC to work consistently and secure access to all the resources Azure AD DS uses, the managed domain and the virtual network must belong to the same Azure AD tenant.

以下规则适用于部署:The following rules apply for deployments:

  • 一个 Azure AD 目录可以包含多个 Azure 订阅。An Azure AD directory may have multiple Azure subscriptions.
  • 一个 Azure 订阅可以包含虚拟网络等多个资源。An Azure subscription may have multiple resources such as virtual networks.
  • 为 Azure AD 目录启用单个托管域。A single managed domain is enabled for an Azure AD directory.
  • 可以在属于相同 Azure AD 租户中任意 Azure 订阅的虚拟网络上启用托管域。A managed domain can be enabled on a virtual network belonging to any of the Azure subscriptions within the same Azure AD tenant.

有效配置Valid configuration

在以下示例部署方案中,将在 Contoso Azure AD 租户中启用 Contoso 托管域。In the following example deployment scenario, the Contoso managed domain is enabled in the Contoso Azure AD tenant. 托管域部署在属于 Contoso Azure AD 租户所有的 Azure 订阅的虚拟网络中。The managed domain is deployed in a virtual network that belongs to an Azure subscription owned by the Contoso Azure AD tenant.

托管域和虚拟网络都属于同一 Azure AD 租户。Both the managed domain and the virtual network belong to the same Azure AD tenant. 此示例配置有效,且完全受支持。This example configuration is valid and fully supported.

作为同一 Azure AD 租户一部分的托管域和虚拟网络的有效 Azure AD DS 租户配置

不匹配的租户配置Mismatched tenant configuration

在此示例部署方案中,将在 Contoso Azure AD 租户中启用 Contoso 托管域。In this example deployment scenario, the Contoso managed domain is enabled in the Contoso Azure AD tenant. 但是,托管域部署在属于 Fabrikam Azure AD 租户所有的 Azure 订阅的虚拟网络中。However, the managed domain is deployed in a virtual network that belongs to an Azure subscription owned by the Fabrikam Azure AD tenant.

托管域以及虚拟网络属于两个不同的 Azure AD 租户。The managed domain and the virtual network belong to two different Azure AD tenants. 此示例配置显示的是不匹配的租户,所以配置不受支持。This example configuration is a mismatched tenant and isn't supported. 必须将虚拟网络移到与托管域相同的 Azure AD 租户。The virtual network must be moved to the same Azure AD tenant as the managed domain.

不匹配的租户配置

解决“不匹配的租户”错误Resolve mismatched tenant error

以下两个选项可解决不匹配的目录错误:The following two options resolve the mismatched directory error:

  • 首先,从现有 Azure AD 目录中删除托管域First, delete the managed domain from your existing Azure AD directory. 然后,在与想要使用的虚拟网络相同的 Azure AD 目录中创建替换托管域Then, create a replacement managed domain in the same Azure AD directory as the virtual network you wish to use. 准备就绪后,将以前加入已删除域的所有计算机加入重新创建的托管域。When ready, join all machines previously joined to the deleted domain to the recreated managed domain.
  • 将包含虚拟网络的 Azure 订阅移动到与托管域相同的 Azure AD 目录。Move the Azure subscription containing the virtual network to the same Azure AD directory as the managed domain.

后续步骤Next steps

有关 Azure AD DS 问题故障排除的详细信息,请参阅故障排除指南For more information on troubleshooting issues with Azure AD DS, see the troubleshooting guide.