We are deploying AX 2012 R3 CU9 on Azure. This is for the development environment. We have setup a Site-to-Site VPN with our on-premise environment. It seems that we still need to setup AD on Azure & do a domain trust. Is this correct? or can we join the AX dev instances on Azure to our on prem AD?
The strategy you mentioned sounds about right. Recently I was involved in an AX 2012 R3 implementation in Microsoft Azure where similar architecture was implemented and it works like a charm.