Since Windows Server VMs cannot be directly joined to Azure AD, you need to setup an Azure AD Domain Service (AAD DS). • It will be synchronized with your Azure AD and allow the VM to join the domain. In fact, AAD DS is an online Domain Controller allowing us to join computers to azure using the standard way like with an on-premises domain. Therefore, it requires also a VPN between the VMs and the Azure Network. Here is a good link explaining AAD DS.
Build a Windows Server based VM
Setup AAD DS in your Azure account by following these 5 steps.
1- Task 1 Enable Azure AD Domain Services
2- Task 2 Configure network settings
3- Task 3 Configure administrative group and Deploy your managed domain
4- Task 4 Update DNS settings for the Azure virtual network
5- Task 5 Enable password hash synchronization to your managed domain for cloud-only user accounts
Note that the Azure AD user will have to reset the password in order to synchronize it to AAD DS and be able to join a computer to the domain.
In your Azure portal,
• Add members in the AAD DC Administrator group. These users will be authorized to join a VM to the domain.
1. Click on Azure Active Directory then Groups and select ADD DC Administrator group
2. Then add the wanted users as member
• Ask the added members to reset their password in order to synchronize it to the created domain. It will take about 20 minutes before they can join a computer to the domain
Follow the following tutorial to Configure a Point-to-Site VPN connection between the VM and the VNet.