You deployed Azure AD DS (aaddscontoso.com) to VNET1 using Admin1. To deploy Windows 10 Enterprise session hosts into a host pool on VNET1 using Admin1, what must you do first?

To join Windows 10 Enterprise session hosts to the Azure AD DS domain (aaddscontoso.com), the user account performing the domain join operation (Admin1 in this case) must be a member of the AAD DC Administrators group. This group has the necessary permissions to perform domain join operations and manage objects within the managed domain. Assigning the Cloud device administrator role to Admin1 is incorrect because this role is for managing devices in Azure AD, not for performing domain join operations to an Azure AD DS managed domain. Assigning a Microsoft 365 Enterprise E3 license to Admin1 is irrelevant to domain joining virtual machines; licenses are for user access to services, not administrative permissions within Azure AD DS. Changing the password of Admin1 is not a prerequisite for domain joining; while good security practice, it doesn't grant the necessary permissions.