receiving a request to expand a directory service in a home region of a provider network into an additional region of the provider network, at least one of the home region or the additional region including two or more availability zones, the request including an identifier associated with the additional region of the provider network;

pre-allocating a classless inter-domain routing (CIDR) block for a virtual network to be provisioned in the additional region of the provider network;

obtaining a global lock on the directory service;

provisioning the virtual network and a plurality of domain controllers in the additional region of the provider network using the CIDR block;

replicating domain controller data from a home domain controller in the home region to the plurality of domain controllers in the additional region; and

establishing peering connections between the plurality of domain controllers in the additional region of the provider network and a plurality of domain controllers in a plurality of other regions of the provider network.