Prepare Azure P2S domain deployment

scripts/Enroll-SguDomainClient.ps1

@@ -22,6 +22,8 @@ param(
     [string]$NewComputerName,
     [string]$NetworkInterfaceAlias = 'Ethernet',
     [string[]]$DomainDnsServerAddresses = @('192.168.50.10'),
+    [ValidateSet('Direct', 'AzureP2S')]
+    [string]$ConnectivityMode = 'Direct',
     [string]$RemoteDesktopPrincipal = 'LCI\SG-Laboratorio-Usuarios-RDP',
     [string]$DotNetRuntimeInstallerPath,
     [string]$RustDeskServerAddress,
@@ -90,9 +92,21 @@ if ($PSCmdlet.ShouldProcess($env:COMPUTERNAME, 'Install and verify SGU before jo
     # The broker uses a domain DNS name even before the machine joins the
     # domain. Point at AD DNS first so the provider-first health check works on
     # a completely clean Windows installation.
-    Set-DnsClientServerAddress `
-        -InterfaceAlias $NetworkInterfaceAlias `
-        -ServerAddresses $DomainDnsServerAddresses
+    if ($ConnectivityMode -eq 'Direct') {
+        Set-DnsClientServerAddress `
+            -InterfaceAlias $NetworkInterfaceAlias `
+            -ServerAddresses $DomainDnsServerAddresses
+    }
+    else {
+        $nrptDisplayName = "SGU Azure P2S DNS - $DomainName"
+        $nrptRule = Get-DnsClientNrptRule -ErrorAction SilentlyContinue |
+            Where-Object DisplayName -eq $nrptDisplayName |
+            Select-Object -First 1
+        if (-not $nrptRule -or
+            @($DomainDnsServerAddresses | Where-Object { @($nrptRule.NameServers) -contains $_ }).Count -eq 0) {
+            throw "AzureP2S enrollment requires the managed NRPT rule '$nrptDisplayName'. Run Install-SguAzureP2sClient.ps1 first."
+        }
+    }
     Resolve-DnsName -Type SRV "_ldap._tcp.dc._msdcs.$DomainName" -ErrorAction Stop | Out-Null
 
     & (Join-Path $PSScriptRoot 'Install-CredentialProvider.ps1') @installParams | Out-Null
@@ -159,6 +173,7 @@ if ($PSCmdlet.ShouldProcess($env:COMPUTERNAME, 'Install and verify SGU before jo
 [pscustomobject]@{
     ComputerName = if ($NewComputerName) { $NewComputerName } else { $env:COMPUTERNAME }
     DomainName = $DomainName
+    ConnectivityMode = $ConnectivityMode
     ProviderValidatedBeforeJoin = $true
     RustDesk = $rustDeskResult
     RestartRequired = [bool]$SkipRestart