Azure Files with identity-based authentication (using Active Directory Domain Services or Azure AD DS) is the correct choice. It provides fully managed SMB file shares in the cloud that support the same SMB protocol, NTFS permissions, and Active Directory integration as on-premises Windows file servers. This allows for a ‘lift-and-shift’ migration with minimal changes to applications or user access patterns. Azure NetApp Files is also SMB-compatible but is typically a premium solution for more specialized, high-performance workloads, not the first recommendation for a standard file server migration.

Configuring the domain controller as a global catalog server is crucial. A global catalog server holds a partial, read-only replica of all objects in the forest, which allows it to process user logon requests (by resolving universal group membership) independently. Without the global catalog, a domain controller cannot complete an authentication request if it cannot contact another global catalog server, making it vulnerable to network segmentation issues. While Availability Sets protect against hardware failures, and DNS is important, they do not address the core authentication dependency.

Creating a custom RBAC role is the most precise and secure method. The built-in ‘Virtual Machine Contributor’ role grants too much permission (including the ability to modify the VM’s network interface and its associated NSG, and to delete the VM). A custom role allows you to explicitly define only the necessary data actions (e.g., Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/restart/action) and assign it scoped directly to the specific VMs, following the principle of least privilege. Assigning Contributor at the resource group level is too broad.

Verifying the PDC Emulator role is online in the recovery site is critical. Many critical functions, including time synchronization for the domain and certain password update processes, depend on the PDC Emulator. If the FSMO role holder is offline in the primary site and hasn’t been transferred to the secondary site, authentication and other domain operations can experience issues. Client DNS settings should be updated via DHCP/DNS replication, not manually. Authoritative restores and promotion from media are for catastrophic recovery, not a standard failover with existing DCs.

Premium SSD v2 is the correct choice. It is designed specifically for demanding workloads like databases. Its key features that meet the requirements are: 1) It provides consistent single-digit millisecond latency and high IOPS/throughput. 2) It supports read/write caching. 3) Most importantly, it allows you to independently scale IOPS, throughput, and storage capacity on-demand without requiring a VM restart or disk detachment, which is a unique advantage over the original Premium SSD tier.

While synchronization runs automatically every 30 minutes, the requirement is for a 15-minute SLA. To achieve this, you must enable and configure the ‘scheduled synchronization task’ (the scheduler built into Azure AD Connect Sync). You can adjust its default cycle from 30 minutes to a custom interval, such as 15 minutes, to meet the specific recovery time objective for identity attribute changes like account disablement. The other options are related to functionality or deployment mode, not the synchronization frequency.

The safest and most methodical approach is to use Azure Network Watcher’s diagnostic tools (like IP flow verify or connection monitor) to empirically confirm there is no active communication to, from, or through the VNet before deletion. This provides a technical verification beyond just checking for attached resources. Deleting immediately is risky. Scripted deletion based on naming conventions is error-prone. Detaching associated resources is a good step but doesn’t confirm the VNet is inactive.

The core architectural difference is the authentication flow. With AD FS, user authentication requests are federated to the on-premises AD FS servers. With Azure AD Connect Cloud Sync (when used with password hash sync or pass-through authentication), authentication is managed by Azure AD itself. This eliminates the need for users to contact on-premises infrastructure during the sign-in process, thereby providing resilience against on-premises outages. Passwords are still used and synced. User objects are still synchronized (via Cloud Sync agents). The sign-in page can still be customized in Azure AD.

A route-based VPN Gateway with BGP enabled is the correct solution. Route-based gateways support active-active configuration (multiple tunnel instances) and dynamic routing protocols like BGP. BGP allows for the automatic exchange of route information between the Azure VPN gateway and the on-premises firewall, ensuring both sides know about network changes without manual static route updates. Policy-based VPNs do not support BGP or active-active mode. ExpressRoute is for private connectivity, not a VPN over the public internet. Virtual WAN is a larger-scale hub-and-spoke architecture that uses these components internally.

Azure Files with identity-based authentication (using Active Directory Domain Services or Azure AD DS) is the correct choice. It provides fully managed SMB file shares in the cloud that support the same SMB protocol, NTFS permissions, and Active Directory integration as on-premises Windows file servers. This allows for a ‘lift-and-shift’ migration with minimal changes to applications or user access patterns. Azure NetApp Files is also SMB-compatible but is typically a premium solution for more specialized, high-performance workloads, not the first recommendation for a standard file server migration.0