AZ493697 - Generally Available: Two-Way Forest Trusts for Microsoft Entra Domain Services

Two-Way Forest Trusts for Microsoft Entra Domain Services are now Generally Available. This capability allows organizations to create forest trusts between Microsoft Entra Domain Services and on-premises Active Directory Domain Services (AD DS) environments in either or both directions.  

Previously Microsoft Entra Domain Services only supported forest trusts in one direction, out-bound from a managed domain to any customer on-premises domains or forests. This allows users in the on-premises domain to access resources in the managed domain, but not vice versa.  

Now, Entra Domain Services supports three possible directions when you create a forest trust: 

1. One-way out-bound: This allows users in the on-premises domain to access resources in the managed domain, but not vice versa. 
2. One-way in-bound: This option allows users in the managed domain to access resources in the on-premises domain.  
3. Two-way: This is a bi-directional trust that allows users in both the managed domain and the on-premises domain to access resources in either domain. 

This capability offers more control and flexibility over how you manage your hybrid identity environment with Entra Domain Services. You can now choose from three possible directions when you create a forest trust, depending on how users need to access resources. An Enterprise or Premium SKU license is required. Trusts require an Enterprise or Premium SKU license. 

Learn more.