To deploy Azure AD Domain Services log into the Azure portal. Once in the portal click on Create a Resource and then search for Domain Services. Select Azure AD Domain Services from the search results and then click Create. Provide the basic information for the domain, including the DNS name for the domain as well as the Subscription you are deploying to, along with a Resource group. You'll also need to supply a Location. Click Okay to move onto the next step. At this point you're prompted to create a Virtual network for the managed domain that you are setting up. Provide a name for the network along with an address space that works for your environment. You will also need to define a Subnet and a Subnet address range that you'd like to use for the managed domain. 

The managed domain controllers and associated infrastructure that gets deployed by Azure as part of the Manage Domain setup will reside on this network and on this subnet. Click Okay and then Okay again. Next you are advised that the AAD DC Administrators group has been created. This group is used to manage the domain. It's similar to but not quite like Domain Admins in an On-Prem Active Directory Domain. Click on the group to add members to it. When you're done adding members that need to manage the domain go back and click Okay. This synchronization step has nothing to do with Azure AD Connect or with On-Prem AD if one exists. Instead, this synchronization step is meant to sync users and groups from Azure AD into Domain Services. You have a choice of syncing all users or scoping the sync to just certain groups. In this demonstration I'm just going to sync all users and groups from Azure AD to Domain Services. Clicking Okay takes you to the next step where you can review your options. Click Okay to commence the deployment of Azure AD Domain Services. 

The actual deployment can take the better part of an hour because it's deploying lots of stuff in the background. It's deploying the network infrastructure that you've defined as well as two managed domain controllers. It's also setting up the managed domain itself. After enabling Azure Active Directory Domain Services you need to enable computers within the Virtual Network to connect to and consume these services. To do so you need to update the DNS Server Settings for your Virtual Network so that it points to the two IP addresses where Azure Active Directory Domain Services are available. To update the DNS Server settings for the Virtual Network hosting your Azure Active Directory Domain Services browse to the Azure portal and open up your instance of Azure AD Domain Services. The Overview tab will list a set of required configuration steps. One of those is to update the DNS Server settings for the Virtual Network. You will be presented with two different IP addresses. These are the IP addresses where Azure AD Domain Services is available. These are essentially the managed domain controllers that were stood up as part of the deployment of Azure AD Domain Services. After making a note of these IP addresses, click the Configure button and update the DNS Server settings for the Virtual Network. With Azure AD Domain Services provisioned and your DNS updated you can now move on and enable password hash synchronization using Azure AD Connect.