In Azure Active Directory Domain Services (Azure AD DS), the service manages the underlying domain controllers, so traditional "Domain Admin" or "Enterprise Admin" privileges are not available to users. Instead, administrative tasks—such as creating and linking Group Policy Objects (GPOs)—are delegated specifically to members of the AAD DC Administrators group. You must sign in with an account in this group to perform these actions.

The objective is to set a password policy for local user accounts on the virtual machines. Local account settings are controlled via the "Computer Configuration" section of a GPO. By default, when a virtual machine joins an Azure AD DS managed domain, its computer object is placed in the AADDC Computers organizational unit (OU). Therefore, to apply the GPO to these VMs, it must be linked to the AADDC Computers OU.

Microsoft Learn. "Administer Group Policy in an Azure Active Directory Domain Services managed domain." Microsoft Entra. Accessed February 10, 2026.

Relevance: Section "Before you begin" states: "You need a user account that's a member of the AAD DC Administrators group in your tenant to administer Group Policy."

Microsoft Learn. "Create and manage organizational units (OUs) in an Azure Active Directory Domain Services managed domain." Microsoft Entra. Accessed February 10, 2026.

Relevance: Section "Default OUs in a managed domain" confirms: "The AADDC Computers OU contains computer objects for all computers that are joined to the managed domain."