Why remove the managed domain
After your Virtual Desktops run on Entra sign-in, the Microsoft Entra Domain Services managed domain from the earlier setup is no longer used by Secureframe. It bills hourly until it is deleted. Microsoft states that billing continues on an hourly basis until you delete the managed domain. See Microsoft's Domain Services FAQ.
Secureframe does not delete it for you. It lives in your subscription, and Secureframe cannot see what else in your tenant may have been built on top of it.
Before you start
You need an account with the Global Administrator role. Microsoft's delete procedure requires it.
Confirm both of the following before you delete anything:
Every desktop has finished converting to Entra sign-in. A desktop that did not convert is still domain-joined and will stop working when the managed domain is deleted. Ask Secureframe to confirm this desktop by desktop before you begin. Do not treat this as something to verify on your own.
Nothing of your own depends on the managed domain. Secureframe only used it for the desktops. Anything you joined to it, or anything using it for LDAP or Kerberos, will stop working. Microsoft states that data on the managed domain is deleted permanently, including custom OUs, GPOs, custom DNS records, service principals, gMSAs, and similar objects you created.
Azure Government portals
Microsoft docs often link to commercial endpoints. In Azure Government use:
Entra admin center:
https://entra.microsoft.usAzure portal:
https://portal.azure.us
Every other step in the linked Microsoft articles is unchanged.
Step 1: Delete the managed domain
This is the step that stops the charge.
Sign in to the Azure Government Microsoft Entra admin center at
https://entra.microsoft.us.Search for and select Microsoft Entra Domain Services.
Select the name of your managed domain.
On the Overview page, choose Delete.
Type the domain name again to confirm.
Microsoft says deletion takes 15 to 20 minutes or more.
Microsoft's instructions: Delete a managed domain (use entra.microsoft.us instead of entra.microsoft.com).
Important: Azure will not delete the virtual network while Domain Services is still attached. Delete the managed domain first. Deleting the resource group first can leave you half finished, with the domain still present and still billing. See Microsoft's note that you cannot delete a virtual network while Domain Services is enabled and connected: Cannot delete VNet.
Step 2: Delete the resource group
After the domain is gone, delete the resource group that held it.
For environments Secureframe provisioned, the group is usually named secureframe-aadds. If you already had a managed domain before Secureframe set yours up, Secureframe may have attached to that one instead, and it may sit in a different subscription. Confirm the exact resource group and subscription with Secureframe before you delete.
That resource group typically contains:
secureframe-aadds-vnetandsecureframe-aadds-subnetsecureframe-aadds-nsgThe private DNS zone
privatelink.file.core.usgovcloudapi.netand its virtual network linksThe virtual network peering back to your desktop environment (disconnected and left behind by the upgrade)
Microsoft also places two network interfaces, a public IP address, and a load balancer there for the domain controllers. Microsoft states that the domain controllers are deprovisioned and removed from the virtual network. Before you delete the group, confirm those three are gone. If any remain, remove them first.
How to delete a resource group: Delete resource group (use portal.azure.us).
Step 3: Delete directory objects the domain needed
These live in your Entra directory, not in the subscription. Deleting the resource group does not remove them. None of them are used by Entra sign-in. Do this after the managed domain is deleted.
In https://entra.microsoft.us:
Group: AAD DC Administrators. It granted administrator rights inside the managed domain, including local administrator on machines joined to it. Those machines are gone, so it now grants nothing. If you later added your own Azure role assignments or app assignments to this group, check those first, then delete the group.
Service account used to join desktops to the domain. Under Users, search for
svc-domain-joinand delete the account it returns. The name issvc-domain-joinfollowed by your environment code (for examplesvc-domain-join-ab12).Conditional Access policy: Block sign-in for svc-domain-join (Secureframe-managed). Delete this after the service account above is gone. It exists only to block that account from signing in.
Do not delete these
Entra sign-in still uses them:
Groups named
Secureframe Enclave Users ...andSecureframe VDI Admins ...Conditional Access policy
Require MFA for Azure Virtual Desktop (Secureframe-managed)The account starting with
svc-quota-automationMicrosoft applications
Domain Controller ServicesandAzureActiveDirectoryDomainControllerServices
Optional tidy-up
The Microsoft Entra Domain Services resource provider registration on the subscription costs nothing ongoing and is not removed by the steps above. You can unregister it if you want. It is optional.
What is not affected
Domain Services synced one way only. No synchronization occurs from Domain Services back to Microsoft Entra ID. See Microsoft's synchronization overview.
Your own users, groups, and passwords are unchanged, apart from the objects you remove in Step 3. Microsoft confirms that deleting the managed domain does not delete or otherwise impact the Microsoft Entra tenant.
Your desktops, profiles, and shared drive run on Entra sign-in and are untouched by this cleanup.
If you ever create a managed domain again later, you will need to reconfigure password hash synchronization. Microsoft: if you delete the managed domain, any password hashes stored at that point are also deleted.
Frequently Asked Questions (FAQ)
Why am I still being billed after Virtual Desktops moved to Entra sign-in?
The Microsoft Entra Domain Services managed domain bills hourly until it is deleted.
Secureframe does not delete it automatically.
Complete Step 1 (delete the managed domain) to stop that charge, then finish Steps 2 and 3.
Can Secureframe delete the managed domain for me?
No. It sits in your subscription, and Secureframe cannot see whether anything else in your tenant depends on it.
Secureframe will confirm desktop conversion and the resource group or subscription details with you before you start.
What happens if I delete the resource group before the managed domain?
Azure can refuse to delete the virtual network while Domain Services is still attached.
You can end up half finished, with the domain still present and still billing.
Always delete the managed domain first, then the resource group.
Will deleting Domain Services affect my Entra users or my Virtual Desktops?
No, for Entra users, groups, and passwords beyond the Step 3 objects you remove.
Desktops, profiles, and the shared drive on Entra sign-in are not affected.
Only delete the objects listed in Step 3. Leave the Entra sign-in groups, MFA policy, quota automation account, and Microsoft Domain Controller Services apps alone.
We already had our own managed domain before Secureframe. Is the resource group still secureframe-aadds?
Not always. Secureframe may have attached to your existing domain.
Confirm the exact resource group and subscription with Secureframe before you delete.
Questions? Contact [email protected] or reach out to your CSM.