Forum Discussion
Device Migration from On-prem AD to Azure AD
I am in the same shoes, and tried a silent join using GPO. Everything went well and upon reboot, the system went through setting up bio metrics etc. (we use biometrics with intune only).
However, upon second reboot the device was unable to verify my PIN.
I reached out to MS, they were unable to help but suggested that as the machine is still joined to AD (GPO enrollment does not drop the AD) the system might be looking fro AD as the login authority and PIN is registered in AAD.
Other that this issue, everything works smooth and it's very silent join seamless for the user.
Quick input as we are in the process of migrating on-prem to native Azure AD.
At this point we have been doing the migration as devices get replaced, but for the rest here is our process.
Log into device with DC admin.
Create local admin user, no password.
Log out and into local user. Remove DC and reboot.
Connect to Azure AD with future user desired (user needs to be in azure/365 and licensed, whichever user you register it with will have admin on the pc).
Once joined, log out of local user and into future azure user (the one you registered with, or your Azure admin).
Remove local user.
Log into the employees account that was using the pc if you aren't already.
We use free profwiz to copy the profile data unattended.
Its not the fastest option, but it drags the old profile data across to the Azure AD profile and no wipe is needed. Total hands on time is about 20-30 minutes on average, can often times do 5-10 units at once by one guy.
Thank you for the reply.
I was able to silently migrate the devices to MDM, only issue was with windows hello fro business.
We did not want to create a new profile/break the user connection, as that would change the profile ID and break things for the user. At the end, we decided to stagger the deployment and work slowly by sending replacement laptops.
- Would/could you provided detail steps on how you managed to silently migrate from AD to AAD joined? Not hybrid, full AAD joined. We too are needing to do this with a domain we have.
Hi,
I was able to join the systems to Intune MDM using the GPO. However, it chose to use AD authentication than windows Hello. So we dropped the plan.
Thanks
