Thanks for your response.

Basically, to provide identity services, Azure creates an AD DS instance on a virtual network of your choice. Behind the scenes, and without the need for you to manage, secure, or update, redundancy is provided through a pair of Windows Server domain controllers.

The Azure AD DS managed domain is configured to perform a one-way synchronization from Azure AD to provide access to a central set of users, groups, and credentials.

You can find fully article regarding Azure Active Directory Domain Services here (Azure ADDS).

https://docs.microsoft.com/en-us/azure/active-directory-domain-services/overview#how-does-azure-ad-ds-work