Azure AD Domain Services is a Microsoft cloud-based offering that provides managed domain services, such as domain join, group policy, LDAP, and Kerberos and NTLM authentication. The domain services provided are fully compatible with traditional on-prem Active Directory and they can be deployed without any need for deployment or management of domain controllers in the cloud. Azure AD Domain Services integrates with the existing Azure AD tenant and makes it possible for users to log in with their corporate credentials. Existing user accounts and groups can be leveraged to secure access to resources. As such, this offers a smoother transition of on-prem resources to Microsoft Azure. Companies leveraging a hybrid IT infrastructure will typically synchronize their identity information from their on-prem directories to the Azure AD tenant. As more of their on-prem applications are migrated to Azure, Azure AD Domain Services can become more useful. An important caveat to consider when deciding if Azure AD Domain services are the right solution is that password sync is mandatory for a hybrid organization to use Azure AD Domain Services. 

This is required because users' credentials are needed for authentication via NTLM and Kerberos in the managed domain that is provided by Azure AD Domain Services. When considering Azure AD Domain Services, keep in mind that the managed domain is actually a stand-alone domain. It is not, and I repeat, it is not an extension of the on-prem AD domain. This is a common misconception among IT professionals. Also, because the domain is managed, the IT administrator does not need to, nor can he, manage, patch, or monitor the domain controllers for the managed domain. Likewise, there is no need to manage or even monitor AD replication within the managed domain. Quite frankly, there really isn't much for the administrator to do in the managed domain, especially since the administrator doesn't even have Domain Admin or Enterprise Admin privileges on the managed domain.