Domain Service

provider "azurerm" {
 features {}
}

resource "azurerm_resource_group" "deploy" {
 name     = "example-resources"
 location = "West Europe"
}

resource "azurerm_virtual_network" "deploy" {
 name                = "deploy-vnet"
 location            = azurerm_resource_group.deploy.location
 resource_group_name = azurerm_resource_group.deploy.name
 address_space       = ["10.0.1.0/16"]
}

resource "azurerm_subnet" "deploy" {
 name                 = "deploy-subnet"
 resource_group_name  = azurerm_resource_group.deploy.name
 virtual_network_name = azurerm_virtual_network.deploy.name
 address_prefixes     = ["10.0.1.0/24"]
}

resource "azurerm_network_security_group" "deploy" {
 name                = "deploy-nsg"
 location            = azurerm_resource_group.deploy.location
 resource_group_name = azurerm_resource_group.deploy.name

 security_rule {
   name                       = "AllowSyncWithAzureAD"
   priority                   = 101
   direction                  = "Inbound"
   access                     = "Allow"
   protocol                   = "Tcp"
   source_port_range          = "*"
   destination_port_range     = "443"
   source_address_prefix      = "AzureActiveDirectoryDomainServices"
   destination_address_prefix = "*"
 }

 security_rule {
   name                       = "AllowRD"
   priority                   = 201
   direction                  = "Inbound"
   access                     = "Allow"
   protocol                   = "Tcp"
   source_port_range          = "*"
   destination_port_range     = "3389"
   source_address_prefix      = "CorpNetSaw"
   destination_address_prefix = "*"
 }

 security_rule {
   name                       = "AllowPSRemoting"
   priority                   = 301
   direction                  = "Inbound"
   access                     = "Allow"
   protocol                   = "Tcp"
   source_port_range          = "*"
   destination_port_range     = "5986"
   source_address_prefix      = "AzureActiveDirectoryDomainServices"
   destination_address_prefix = "*"
 }

 security_rule {
   name                       = "AllowLDAPS"
   priority                   = 401
   direction                  = "Inbound"
   access                     = "Allow"
   protocol                   = "Tcp"
   source_port_range          = "*"
   destination_port_range     = "636"
   source_address_prefix      = "*"
   destination_address_prefix = "*"
 }
}

resource "azurerm_subnet_network_security_group_association" "deploy" {
 subnet_id                 = azurerm_subnet.deploy.id
 network_security_group_id = azurerm_network_security_group.deploy.id
}

resource "azuread_group" "dc_admins" {
 display_name     = "AAD DC Administrators"
 security_enabled = true
}

resource "azuread_user" "admin" {
 user_principal_name = "dc-admin@hashicorp-example.com"
 display_name        = "DC Administrator"
 password            = "Pa55w0Rd!!1"
}

resource "azuread_group_member" "admin" {
 group_object_id  = azuread_group.dc_admins.object_id
 member_object_id = azuread_user.admin.object_id
}

resource "azuread_service_principal" "example" {
 application_id = "2565bd9d-da50-47d4-8b85-4c97f669dc36" // published app for domain services
}

resource "azurerm_resource_group" "aadds" {
 name     = "aadds-rg"
 location = "westeurope"
}

resource "azurerm_active_directory_domain_service" "example" {
 name                = "example-aadds"
 location            = azurerm_resource_group.aadds.location
 resource_group_name = azurerm_resource_group.aadds.name

 domain_name           = "widgetslogin.net"
 sku                   = "Enterprise"
 filtered_sync_enabled = false

 initial_replica_set {
   subnet_id = azurerm_subnet.deploy.id
 }

 notifications {
   additional_recipients = ["notifyA@example.net", "notifyB@example.org"]
   notify_dc_admins      = true
   notify_global_admins  = true
 }

 security {
   sync_kerberos_passwords = true
   sync_ntlm_passwords     = true
   sync_on_prem_passwords  = true
 }

 tags = {
   Environment = "prod"
 }

 depends_on = [
   azuread_service_principal.example,
   azurerm_subnet_network_security_group_association.deploy,
 ]
}

az ad ds create --domain
               --name
               --replica-sets
               --resource-group
               [--domain-config-type {FullySynced, ResourceTrusting}]
               [--external-access {Disabled, Enabled}]
               [--filtered-sync {Disabled, Enabled}]
               [--ldaps {Disabled, Enabled}]
               [--no-wait]
               [--notify-dc-admins {Disabled, Enabled}]
               [--notify-global-admins {Disabled, Enabled}]
               [--notify-others]
               [--ntlm-v1 {Disabled, Enabled}]
               [--pfx-cert]
               [--pfx-cert-pwd]
               [--resource-forest {Disabled, Enabled}]
               [--settings]
               [--sku {Enterprise, Premium, Standard}]
               [--sync-kerberos-pwd {Disabled, Enabled}]
               [--sync-ntlm-pwd {Disabled, Enabled}]
               [--sync-on-prem-pwd {Disabled, Enabled}]
               [--tags]
               [--tls-v1 {Disabled, Enabled}]

az ad ds create --domain "TestDS.com" --replica-sets location="West US" subnet-id="<subnetId>" --name "TestDS.com" --resource-group "rg"