Windows – Creating a multi-tenant AD environment

I would slightly alter your architecture:

Windows Azure comes with a load-balancer built-in. Install all your websites onto a single Webrole that can be spread across multiple instances. Configure your multi-tenant application to route the requests internally based upon the source/customer/url.

If you are truly multi-tenant, you will have a single code-base. The content that is seen by the user is dependent upon their context/user-id/etc. This way, you have one application, everyone shares the resources of your instances in a round-robin way, and no single server can stand in a way of failure.

Putting 50 sites on one server, another 50 sites on another server, etc.. is the "old" non-cloud way of dealing with things. Your server goes out, and 50 customers are down. And not have the agility/scalability when one of the customers becomes "too hot" for a single server.

This is very similar to what we do. We have a single TS Gateway that all our clients enter through. This has connection and resource policies that control which user groups can log on to which servers.

Each company has their own self-contained terminal server. Most companies can only log on to the one TS, but for one particularly large client, they have two. We don't do any clustering of them, just half the users connect to TS1 and the other half connect to TS2.

All the servers sit on the same network segment, and we have very strict ACLs to define who can go where on the network (i.e. nobody can really go anywhere). Our GPO for the RDS servers also greatly restricts where they can go on the server itself.

The biggest issue that we have with this setup is the automated deployment of servers for new clients. Most of the process can be automated (we use ESXi and vSphere, which has powershell integration. Same as Hyper-V does), but I haven't yet found out how to automate the modification of TS Gateway policies.

We also have one very large client who uses our hosted terminal servers. Because I didn't want to bother with managing all their password resets and new accounts myself, we gave them delegation rights over their own OU on the domain. When they started to out-grow that, for political reasons, we gave them their own domain under our forest. That's all worked pretty well so far as well, except you can't use the User must change their password on next logon as this is incompatible with TS Gateway. Same deal when their password expires, they can't log on and someone needs to reset their password manually.