Deploying AD DS only on an Azure VM is best suitable for the: - Applications based upon Kerberos authentication but having no requirements related to on- premises directory services. - Greenfield deployments with no existing on-premises AD DS environment. Reference: https://docs.microsoft.com/en-us/learn/modules/deploy-manage-azure-iaas-active-directory- domain-controllers-azure/02-select-option-implement-directory-identity-services