When this applies
When your Azure Government tenant is created, its .onmicrosoft.us name is permanent and can never be changed. Secureframe Virtual Desktops rely on Microsoft Entra Domain Services, which caps the first segment of the managed domain name behind your desktops at 15 characters. This is a Microsoft limit that cannot be waived, so if your tenant name (everything before .onmicrosoft.us) is longer than 15 characters, desktop provisioning fails.
For example, acme.onmicrosoft.us works, and acmemanufacturer.onmicrosoft.us (16 characters) is blocked.
If you have not created your tenant yet, none of this applies to you. Keep the name to 15 characters or fewer. See Prerequisites to setting up your Virtual Desktops.
The fix: add an adsf subdomain
Since the tenant name cannot be changed, the fix is to give your desktop infrastructure a shorter name to run under. You add and verify adsf.yourdomain.com (using your organization's own domain) as a custom domain in your tenant. The four-character adsf label fits within Microsoft's limit, and it is the subdomain Secureframe uses for your desktop infrastructure.
Note: Your organization's primary domain must already be added and verified as a custom domain in your tenant before you start. Verifying the primary domain alone is not enough, since Microsoft requires the subdomain to be verified independently.
In the Microsoft Entra admin center, go to Custom domain names and add
adsf.yourdomain.com. Because your primary domain is already verified, Microsoft often verifies the subdomain automatically.If it is not verified automatically, add a TXT record at your domain registrar with
adsfas the host and theMS=ms########value shown in Entra. Some registrars append your domain to the host automatically, so enter justadsf, not the full subdomain.Return to Entra and click Verify.
Confirm that both your primary domain and
adsf.yourdomain.comshow as verified, and send a screenshot to your Secureframe team. That confirmation unblocks desktop provisioning.
Frequently Asked Questions (FAQ)
Can I rename my tenant instead?
No. The .onmicrosoft.us name is set permanently when the tenant is created. Microsoft does not allow it to be changed, which is why the subdomain is the path forward.
Does this change anything for my day-to-day Microsoft environment?
The subdomain exists to name your desktop infrastructure. Your primary domain stays your primary domain.
Why ADSF?
This is an abbreviation of Active Directory Secureframe.
Questions? Contact [email protected] or reach out to your CSM.