It's slightly complicated and depends on your AD topology. In general, most of the configurations we've done have been a single domain in AD. You could create an OU for Azure, but I probably wouldn't go as far as creating a child domain.