Update on Azure Domain Services API issue: I've managed to work around the issue (which goes against their instructions in their docs) so the azure domain services API is supposed to build a few things in its workflow, an NSG, 2 Nics, LB and a namespace. The API currently doesn't build the NSG which is what lets their backend VM test ports. In order to get around the issue we can build the NSG ourselves and associate it with the subnet that Domain Services is being deployed to. Their documentation explicitly says not to do this but..... _¯\_(ツ)_/¯. Anywho so you create the NSG with the following rules and make sure to use the service tags:_

export const AllowPSRemoting = {
    name: "AllowPSRemoting",
    priority: 301,
    direction: "Inbound",
    access: "Allow",
    protocol: "Tcp",
    sourcePortRange: "*",
    destinationPortRange: "5986",
    sourceAddressPrefix: "AzureActiveDirectoryDomainServices",
    destinationAddressPrefix: "*",
}


export const AllowRD = {
    name: "AllowRD",
    priority: 201,
    direction: "Inbound",
    access: "Allow",
    protocol: "Tcp",
    sourcePortRange: "*",
    destinationPortRange: "3389",
    sourceAddressPrefix: "CorpNetSaw",
    destinationAddressPrefix: "*",
}

export const PortForWACService = {
    name: "PortForWACService",
    priority: 100,
    direction: "outbound",
    access: "Allow",
    protocol: "Tcp",
    sourcePortRange: "*",
    destinationPortRange: "443",
    sourceAddressPrefix: "VirtualNetwork",
    destinationAddressPrefix: "WindowsAdminCenter",
}

@gentle-diamond-70147 we may wanna add this to the Pulumi docs just to help the community or put it somewhere we can share the info around