You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory-domain-services/active-directory-ds-suspension.md
+25-32Lines changed: 25 additions & 32 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -14,25 +14,25 @@ ms.workload: identity
14
14
ms.tgt_pltfrm: na
15
15
ms.devlang: na
16
16
ms.topic: article
17
-
ms.date: 07/16/2018
17
+
ms.date: 07/18/2018
18
18
ms.author: ergreenl
19
19
20
20
---
21
21
# Suspended domains
22
-
When Azure AD Domain Services is unable to service a managed domain for a long period of time, the managed domain is put into a suspended state. This article will explain why managed domains are suspended, the length of suspension, and how to remediate a suspended domain.
22
+
When Azure AD Domain Services is unable to service a managed domain for a long period of time, the managed domain is put into a suspended state. This article explains why managed domains are suspended, and how to remediate a suspended domain.
The preceding graphic outlines how a domain is suspended, how long it will be suspended, and ultimately, the deletion of a managed domain. The following sections detail the reasons why a domain can be suspended and how to unsuspend a managed domain.
29
+
The preceding graphic outlines the possible states an Azure AD Domain Services managed domaincan be in.
30
30
31
31
### 'Running' state
32
32
A managed domain that is configured correctly and operating regularly is in the **Running** state.
33
33
34
34
**What you can expect:**
35
-
* Microsoft is able to regularly monitor the health of your managed domain.
35
+
* Microsoft can regularly monitor the health of your managed domain.
36
36
* Domain controllers for your managed domain are patched and updated regularly.
37
37
* Changes from Azure Active Directory are regularly synchronized to your managed domain.
38
38
* Regular backups are taken for your managed domain.
@@ -47,66 +47,59 @@ For more information, see [how to troubleshoot alerts on a managed domain](activ
47
47
48
48
**What you can expect:**
49
49
50
-
In some instances (for example, if you have an invalid network configuration), the domain controllers for your managed domain may be unreachable. Therefore, Microsoft cannot guarantee your managed domain is monitored, patched, updated or backed-up on a regular basis in this state.
50
+
In some instances (for example, if you have an invalid network configuration), the domain controllers for your managed domain may be unreachable. Microsoft can't guarantee your managed domain is monitored, patched, updated, or backed-up on a regular basis in this state.
51
51
52
-
* Your managed domain is in an unhealthy state and ongoing health monitoring may be impacted, until the alert is resolved.
52
+
* Your managed domain is in an unhealthy state and ongoing health monitoring may stop, until the alert is resolved.
53
53
* Domain controllers for your managed domain may not be patched or updated.
54
54
* Changes from Azure Active Directory may not be synchronized to your managed domain.
55
55
* Backups for your managed domain may be taken, if possible.
56
56
* If you resolve the alerts impacting your managed domain, it may be possible to restore your managed domain to the 'Running' state.
57
-
* Critical alerts are triggered for configuration issues where Microsoft is unable to reach your domain controllers. If such alerts are not resolved within 15 days, your managed domain will be put in the 'Suspended' state.
57
+
* Critical alerts are triggered for configuration issues where Microsoft is unable to reach your domain controllers. If such alerts aren't resolved within 15 days, your managed domain will be put in the 'Suspended' state.
58
58
59
59
60
60
### 'Suspended' state
61
61
A managed domain is put in the **Suspended** state for the following reasons:
62
-
* One or more critical alerts have not been remediated in 15 days. This can be caused by a misconfiguration that blocks access to resources needed by Azure AD Domain Services.
62
+
* One or more critical alerts haven't been resolved in 15 days. Critical alerts can be caused by a misconfiguration that blocks access to resources needed by Azure AD Domain Services.
63
63
* For example, if the managed domain has alert [AADDS104: Network Error](active-directory-ds-troubleshoot-nsg.md) unresolved for over 15 days.
64
-
* There is a billing issue with your Azure subscription or if the Azure subscription has expired.
64
+
* There's a billing issue with your Azure subscription or your Azure subscription has expired.
65
65
66
-
Managed domains are suspended when Microsoft is unable to manage, monitor, patch or backup the domain on an ongoing basis.
66
+
Managed domains are suspended when Microsoft is unable to manage, monitor, patch, or backup the domain on an ongoing basis.
67
67
68
68
**What you can expect:**
69
-
* Domain controllers for your managed domain are de-provisioned and are not reachable within the virtual network.
69
+
* Domain controllers for your managed domain are de-provisioned and aren't reachable within the virtual network.
70
70
* Secure LDAP access to the managed domain over the internet (if enabled) stops working.
71
-
* You will see failures in authenticating to the managed domain, logging on to domain joined virtual machines, connecting over LDAP/LDAPS etc.
71
+
* You notice failures in authenticating to the managed domain, logging on to domain joined virtual machines, and connecting over LDAP/LDAPS.
72
72
* Backups for your managed domain are no longer taken.
73
-
* You need to resolve the alert causing your managed domain to be in the 'Suspended' state and then contact support.
74
-
* Support may be able to restore your managed domain, only if there is an existing backup that is less than 30 days old.
73
+
* Synchronization with Azure AD stops.
74
+
* Resolve the alert causing your managed domain to be in the 'Suspended' state and then contact support.
75
+
* Support may restore your managed domain, only if a backup that is less than 30 days old exists.
76
+
77
+
The managed domain will only stay in a suspended state for 15 days. To recover your managed domain, Microsoft recommends you resolve critical alerts immediately.
75
78
76
79
77
80
### 'Deleted' state
78
81
A managed domain that stays in the 'Suspended' state for 15 days is **Deleted**.
79
82
80
83
**What you can expect:**
81
84
* All resources and backups for the managed domain are deleted.
82
-
* You cannot restore the managed domain and will need to create a new managed domain to use Azure AD Domain Services.
83
-
* You will not be billed for the managed domain.
84
-
85
-
86
-
## What happens when a managed domain is suspended?
87
-
When a domain is suspended, Azure AD Domain Services stops and de-provisions the domain controllers for your managed domain. As a result, backups are no longer taken, users are unable to sign-in to your domain, and synchronization with Azure AD stops.
85
+
* You can't restore the managed domain and need to create a new managed domain to use Azure AD Domain Services.
86
+
* Once deleted, you aren't billed for the managed domain.
88
87
89
-
The managed domain will only stay in a suspended state for a maximum of 15 days. In order to ensure a timely recovery, it is recommended you address the suspension as soon as possible.
90
88
89
+
## How do you know if your managed domain is suspended?
90
+
You see an [alert](active-directory-ds-troubleshoot-alerts.md) on the Azure AD Domain Services Health page in the Azure portal that declares the domain suspended. The state of the domain also shows "Suspended".
91
91
92
-
## How do I know if my managed domain is suspended?
93
-
You will see an [alert](active-directory-ds-troubleshoot-alerts.md) on the Azure AD Domain Services Health page in the Azure portal that declares the domain suspended. In addition, the state of the domain shows "Suspended".
94
92
95
-
96
-
## How do I restore a suspended domain?
93
+
## Restore a suspended domain
97
94
To restore a domain in the 'Suspended' state, complete the following steps:
98
95
99
96
1. Navigate to the [Azure AD Domain Services page](https://portal.azure.com/#blade/HubsExtension/Resources/resourceType/Microsoft.AAD%2FdomainServices) on the Azure portal
100
-
2. Click on the domain you wish to unsuspend
101
-
3. On the left-hand navigation, click **Health**
97
+
2. Click on the managed domain.
98
+
3. On the left-hand navigation, click **Health**.
102
99
4. Click on the alert. The alert ID will be either AADDS503 or AADDS504, depending on the cause of suspension.
103
100
5. Click on the resolution link provided in the alert and follow the steps to resolve the alert.
104
101
105
-
Your domain can only be restored to the date of last backup. The date of your last backup is displayed on the Health page of your managed domain. Any changes that occurred after the last backup will not be restored. Backups for a managed domain are stored for up to 30 days. Backups older than 30 days are deleted.
106
-
107
-
108
-
## Deleting domains
109
-
If the domain is suspended for more than 15 days, Azure AD Domain Services deletes the managed domain due to inactivity and the inability to service the domain. You will no longer be billed for Azure AD Domain Services. At this point, you cannot restore your managed domain and need to recreate it.
102
+
Your managed domain can only be restored to the date of last backup. The date of your last backup is displayed on the Health page of your managed domain. Any changes that occurred after the last backup won't be restored. Backups for a managed domain are stored for up to 30 days. Backups older than 30 days are deleted.
The above operation will federate the domain fabrikam.com with the same AD FS. You can verify the domain settings by using Get-MsolDomainFederationSettings for both domains.
At the **end of July 2018**, you'll notice that all Azure AD emails will have an updated design, sender email address, and sender display name when sent from the following services:
45
+
46
+
- Azure AD Identity Protection
47
+
- Azure AD Connect Health
48
+
- Azure AD Provisioning Service
49
+
- Azure AD Enterprise Application Management
50
+
- Azure AD Access Reviews
51
+
- Azure AD Privileged Identity Management
52
+
53
+
Also at that time, email notifications will start to use the following address:
Copy file name to clipboardExpand all lines: articles/active-directory/manage-apps/tenant-restrictions.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -112,7 +112,7 @@ Tenant Restrictions is currently supported by Office 365 browser-based applicati
112
112
113
113
Outlook and Skype for Business clients that support modern authentication may still able to use legacy protocols against tenants where modern authentication is not enabled, effectively bypassing Tenant Restrictions. Applications that use legacy protocols may be blocked by Tenant Restrictions if they contact login.microsoftonline.com, login.microsoft.com, or login.windows.net during authentication.
114
114
115
-
For Outlook on Windows, customers may choose to implement restrictions preventing end users from adding non-approved mail accounts to their profiles. For example, see the [Prevent adding non-default Exchange accounts](http://gpsearch.azurewebsites.net/default.aspx?ref=1) group policy setting. For Outlook on non-Windows platforms, and for Skype for Business on all platforms, full support for Tenant Restrictions is not currently available.
115
+
For Outlook on Windows, customers may choose to implement restrictions preventing end users from adding non-approved mail accounts to their profiles. For example, see the [Prevent adding non-default Exchange accounts](http://gpsearch.azurewebsites.net/default.aspx?ref=1) group policy setting.
0 commit comments