本页介绍了网域对等互连在 Managed Service for Microsoft Active Directory (Managed Microsoft AD) 中的运作方式。
托管式 Microsoft AD 提供由 Google Cloud托管的高可用性安全强化型 Microsoft Active Directory 网域。已获授权的网络可在网域资源项目中的 VPC 上提供托管式 Microsoft AD。借助网域对等互连，非网域资源项目（例如 VPC 资源项目）也可以使用 Managed Microsoft AD。
网域对等互连的运作方式
代管式 Microsoft AD 会在网域资源项目和 VPC 资源项目中创建网域对等互连资源。这样做是为了确保在连接网络之前，这两个项目可以查看对等互连，并经过相应运维者的同意。
成功配置网域对等互连后，托管式 Microsoft AD VPC 将与 VPC 网络建立对等互连，并创建一个 Cloud DNS 对等互连区域以提供无缝的网域发现功能。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-11。"],[],[],null,["# Domain peering overview\n\nThis page describes how domain peering works in Managed Service for Microsoft Active Directory (Managed Microsoft AD).\n\nManaged Microsoft AD offers highly available and\nhardened Microsoft Active Directory domains hosted by Google Cloud. Authorized networks make Managed Microsoft AD available on your VPC in the domain resource project. Domain peering makes Managed Microsoft AD available to non-domain-resource projects, such as VPC resource projects, as well.\n\nHow domain peering works\n------------------------\n\nManaged Microsoft AD creates a domain peering resource in both the domain\nresource project and the VPC resource project. This ensures that\nboth projects have visibility to peering and appropriate operators have provided\ntheir consent before networks are connected.\n\nAfter you have successfully configured a domain peering, Managed Microsoft AD VPC peers with the VPC networks and creates a Cloud DNS peering zone to provide seamless domain\ndiscovery.\n\nYou must configure domain peering only after you [create the domain](/managed-microsoft-ad/docs/create-domain). If a domain\nalready exists, you must\n[configure peering for both projects](/managed-microsoft-ad/docs/quickstart-domain-peering).\n| **Note:** When you configure multiple domain peerings with the same domain, VPC networks can communicate with domain controllers over the peered connection but can't communicate with each other. If there is a need for VPC networks to communicate with each other, you need to create a separate peering since VPC peerings are non-transitive.\n\nHow domain peering differs from authorized network\n--------------------------------------------------\n\nManaged Microsoft AD domain supports adding up to 5 authorized networks from the domain resource project. Additionally, domain\npeering lets you add up to 10 networks to the Managed Microsoft AD domain from other projects.\n\nWith Managed Microsoft AD domain peering, the authorized network originates\nfrom projects other than the domain resource project. This functionality\nprovides the flexibility of sharing a single Managed Microsoft AD domain with multiple projects\nand networks outside the domain resource project. This makes it possible to\nuse different deployment models such as hub and spoke.\n\nWhat's next\n-----------\n\n- [Create a domain](/managed-microsoft-ad/docs/quickstart-create-domain)\n- [Configure domain peering](/managed-microsoft-ad/docs/quickstart-domain-peering)"]]
