Microsoft Entra Domain Services (formerly Azure AD Domain Services) reports problems with a managed domain as health alerts with IDs such as AADDS104 or AADDS500. Some clear on their own; others start a clock that ends with the managed domain suspended and then deleted. This quick reference lists every alert ID Microsoft documents, what it means, the usual cause and the first thing to do.
Codes in this quick reference
AADDS100 Missing directory: The Microsoft Entra directory associated with your managed domain may have been deleted.Domain Services Health pageAADDS101: Microsoft Entra Domain Services cannot be enabled in an Azure AD B2C Directory.Domain Services Health pageAADDS101 Secure LDAP network configuration: access to port 636 is not locked down using a network security groupDomain Services Health pageAADDS102 Service principal not found: a service principal required for Domain Services was deletedDomain Services Health pageAADDS103 Address is in a public IP range: the virtual network uses a public IP address rangeDomain Services Health pageAADDS104 Network error: Microsoft is unable to reach the domain controllers for this managed domain.Domain Services Health pageAADDS105 Password synchronization application is out of date: sync service principal deleted and recreatedDomain Services Health pageAADDS106 Your Azure subscription is not found: the managed domain's subscription was deletedDomain Services Health page
+ 22 more codes in the tables below.
How to read these alerts#
- Where: in the Microsoft Entra admin center, search for Microsoft Entra Domain Services, select the managed domain, then Health. You see the overall status, two monitors (Backup and Synchronization with Microsoft Entra ID) and the alert list. Each alert has a first-seen timestamp and a link to its resolution steps.
- Status values: Running (at most informational alerts), Needs attention (warning), Needs attention (critical) and Deploying. Critical alerts mean the Azure platform can't monitor, manage, patch or synchronize the domain.
- Timing: health is evaluated every hour (see Last evaluated). After a fix, most alerts clear within two hours; AADDS600 can take six.
- The clock: a critical alert left unresolved for 15 days suspends the managed domain, and a domain that stays suspended for 15 days is deleted. Deletion can't be undone. Backups are kept for up to 30 days.
- One ID, two alerts: Microsoft's documentation uses AADDS101 both for a B2C directory and for unrestricted secure LDAP. Read the message, not just the number.
Watch out: several fixes below mean deleting and recreating the managed domain. That's disruptive: the domain is unavailable and anything you created inside it, such as custom OUs or service accounts, is lost. Export what you need first.
Directory, subscription and service principal alerts#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
AADDS100 Missing directory | The Microsoft Entra directory associated with your managed domain may have been deleted. | Subscription moved to a new directory, or the old directory deleted | Unrecoverable: delete the managed domain and recreate it in the new directory |
AADDS101 Azure AD B2C is running in this directory | Microsoft Entra Domain Services cannot be enabled in an Azure AD B2C Directory. | Domain Services deployed in a B2C tenant | Delete it, create a directory that isn't B2C, deploy a replacement there |
AADDS102 Service principal not found | A service principal Domain Services needs was deleted from the directory | The service principal was deleted | Search Enterprise applications (All applications) for the IDs in the box below |
AADDS105 Password synchronization application is out of date | The sync service principal (d87dcbc6-a371-462e-88e3-28ad15ec4e64) was deleted and recreated, leaving inconsistent permissions | Manual deletion and recreation | Delete the Azure AD Domain Services Sync application; the platform recreates it and resumes password sync |
AADDS106 Your Azure subscription is not found | The subscription behind the managed domain was deleted | Subscription cleanup | Create a subscription, delete the managed domain, recreate it (it can't move subscriptions) |
AADDS107 Your Azure subscription is disabled | The subscription isn't active | Billing or expiry | Renew it, then re-enable the domain from the Domain Services notification |
AADDS108 Subscription moved directories | The subscription now sits in another directory | Subscription transfer | Move it back, or delete and recreate the domain in the chosen subscription |
AADDS111 Service principal unauthorized | A service principal can't manage resources in the subscription | Role assignments changed | Restore the access removed from service principal abba844e-bc0e-44b0-947a-dc74e5d09022 |
For AADDS102, Microsoft maps each missing application ID to a fix. 2565bd9d-da50-47d4-8b85-4c97f669dc36 (Azure Global; other clouds use 6ba9a5d4-8456-4118-b521-9c5ca10cdf84) is recreated with Graph PowerShell. If 443155a6-77f3-45e3-882b-22b3a8d431fb, abba844e-bc0e-44b0-947a-dc74e5d09022 or d87dcbc6-a371-462e-88e3-28ad15ec4e64 is missing, re-register the resource provider in the Azure portal: Subscriptions › your subscription › Settings › Resource providers › Microsoft.AAD › Re-register.
PowerShell
Connect-MgGraph -Scopes "Application.ReadWrite.All"
# AADDS102: recreate the Domain Services service principal if this returns nothing
Get-MgServicePrincipal -Filter "appId eq '2565bd9d-da50-47d4-8b85-4c97f669dc36'"
New-MgServicePrincipal -AppId "2565bd9d-da50-47d4-8b85-4c97f669dc36"
# AADDS105: remove the stale sync application; the platform recreates it
$app = Get-MgApplication -Filter "DisplayName eq 'Azure AD Domain Services Sync'"
Remove-MgApplication -ApplicationId $app.IdNetwork and resource alerts#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
AADDS101 Secure LDAP network configuration | Secure LDAP over the internet is on, but port 636 isn't locked down by a network security group (NSG) | LDAPS published without a source restriction | Add an inbound TCP 636 allow rule limited to known source IPs (for example RestrictLDAPS) |
AADDS103 Address is in a public IP range | The virtual network uses a public IP range | Address space chosen at deployment | Recreate the domain in a subnet with a private range; ignorable only if you own that public range, without SLA |
AADDS104 Network error | Microsoft is unable to reach the domain controllers for this managed domain. | NSG rules, or a user-defined route blocking inbound traffic | Compare AADDS-<domain>-NSG with the default rules below; remove blocking custom rules |
AADDS109 Resources for your managed domain cannot be found | A resource the domain needs (public IP, NIC, load balancer) was deleted | Cleanup in the resource group | If the alert is under 4 hours old the platform may recreate it; otherwise recreate the domain or open a support case |
AADDS110 The subnet associated with your managed domain is full | No room for an extra domain controller | Your own VMs in the Domain Services subnet | Unrecoverable: delete and recreate; keep the subnet dedicated |
AADDS112 Not enough IP address in the managed domain | Fewer than two free addresses (3–5 spare recommended) | Other VMs or a small subnet | Recreate the domain in a large enough range |
AADDS113 Resources are unrecoverable | Domain Services resources were modified into a state it can't repair | Manual changes to managed resources | Open an Azure support request |
AADDS114 Subnet invalid | The deployment subnet can't be used | Subnet configuration | Unrecoverable: delete and recreate |
AADDS115 Resources are locked | The platform can't change network resources: the scope is locked | Resource locks on the VNet, NIC or public IP | Check each component's operation logs, then remove the lock under Locks |
AADDS116 Resources are unusable | The platform can't change network resources: a policy blocks it | Restrictive Azure Policy assignment | Find the policy in the operation logs and make it less restrictive |
The default NSG rules Microsoft lists: inbound AllowPSRemoting (TCP 5986 from the AzureActiveDirectoryDomainServices service tag, priority 301), AllowRD (TCP 3389 from CorpNetSaw, priority 201, optional and only for debugging), plus the built-in virtual network and load balancer rules. Outbound access from the virtual network must stay unrestricted.
Configuration and security alerts#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
AADDS120 | The managed domain has encountered an error onboarding one or more custom attributes | An extension's LDAPName conflicts with the built-in AD schema | Remove the failed attributes on the Custom Attributes page, wait for them to leave the AADDSCustomAttributes OU, then add them again |
AADDS122 Group policy object conflict detected (preview) | GPO settings on the domain controllers conflict | Edited GPOs | Fix the entries or restore the GPO from backup. Alerts repeat every 7 days; after 30 days the service fixes it automatically, possibly losing GPO data |
AADDS123 Kerberos RC4 usage detected for service ticket issuance | RC4 tickets that can block the CVE-2026-20833 hardening | Workloads or service accounts that still need RC4 | Turn off RC4 in the domain's security settings; if something depends on it, audit events 4768 and 4769 first |
AADDS502 Secure LDAP certificate expiring | The secure LDAP certificate will expire on the date shown | Certificate lifetime | Create and apply a replacement, then distribute it to every LDAPS client |
Note: Microsoft's schedule for the CVE-2026-20833 RC4 hardening ends with a final enforcement phase in July 2026 that removes rollback support, so treat AADDS123 as urgent. Members of AAD DC Administrators can stage the change through rc4-configuration.json on the hidden \\<DC name>\CustomerExecutionScripts$ share (start with audit mode, rc4DefaultDisablementPhase 1) and confirm it in rc4-status.json about 10 minutes later. Each change restarts the KDC on that DC, so stagger it. To find RC4 callers, see the Kerberos event reference.
Sync, backup and suspension alerts#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
AADDS500 Synchronization has not completed in a while | The last sync from Microsoft Entra ID is old; sign-ins and group memberships may be stale | Blocked network connectivity, or password sync never set up | Clear other alerts first, wait two hours, recheck; confirm password sync is set up for cloud-only and hybrid users |
AADDS501 A backup has not been taken in a while | The managed domain was last backed up on [date]. | Network configuration blocking the platform | Resolve active alerts; the monitor should show a backup 1 to 14 days old |
AADDS503 Suspension due to disabled subscription | Suspended because the subscription isn't active | Billing | Renew the subscription and re-enable the domain from the notification |
AADDS504 Suspension due to an invalid configuration | Suspended: the service couldn't manage or patch the domain controllers for a long time | A critical alert ignored for 15 days | Fix the alerts, then open a support request to re-enable; support can restore from a backup under 30 days old |
AADDS600 Unresolved health alerts for 30 days | Listed alerts block critical security updates; suspension follows if they stay open | Long-ignored alerts | Resolve each listed alert ID, then wait six hours |
Last backup was taken more than 14 days ago. | Backup monitor: automated backups failing | Active critical alerts | Resolve them; open a support request if it doesn't update. Never backed up is normal for the first 24 hours |
| Needs attention (critical) | One or more critical alerts | Usually AADDS104 or another network alert | Fix within 15 days to avoid suspension |
| Suspended | Domain controllers deprovisioned; sign-ins, LDAP/LDAPS, backups and sync stop | Critical alert open 15 days, or a billing problem | Open the AADDS503 or AADDS504 alert and follow it; 15 more days and the domain is deleted |
How to verify a fix#
- On the Health page, wait for a Last evaluated time after your change, then for the alert to disappear (up to two hours, six for AADDS600). The status returns to Running.
- Check both monitors: a recent synchronization time and a last backup within 1 to 14 days.
- From a domain-joined VM, sign in with a synced account and run
nltest /dsgetdc:aaddscontoso.com(your domain name) to confirm a domain controller answers. - For secure LDAP, test TCP 636 from an allowed source and from a blocked one: only the allowed source should connect.
Domain join and sign-in problems against the managed domain behave like on-premises AD; the domain join reference and the LDAP bind reference cover those errors.
References#
- Common alerts and resolutions in Microsoft Entra Domain Services (Microsoft Learn)
- Resolve service principal alerts in Microsoft Entra Domain Services (Microsoft Learn)
- Resolve network security group alerts in Microsoft Entra Domain Services (Microsoft Learn)
- Resolve secure LDAP alerts in Microsoft Entra Domain Services (Microsoft Learn)
- Suspended domains in Microsoft Entra Domain Services (Microsoft Learn)
- Check the health of Microsoft Entra Domain Services (Microsoft Learn)
