Forum Discussion

JonasBack's avatar
JonasBack
Iron Contributor
Nov 24, 2018

From Azure AD Registered devices to Hybrid Azure AD joined

Very aware of the two technologies and how they differ/work and how to set u it up. I inherited an old environment and they have all their Windows 10 devices Azure AD registered (not syncing OU wit...
Azure Active Directory (AAD)
KyleF645's avatar
KyleF645
Copper Contributor
Feb 27, 2019
Thanks! So in your testing, devices below 1809 that were already registered in Azure AD are indeed successfully hybrid joining? Does that create a duplicate device in Azure AD?
JonasBack's avatar
JonasBack
Iron Contributor
Feb 27, 2019
Correct, it seems to work (we use Conditional Access to require "Hybrid Azure AD joined" to access some cloud apps). However, you see duplicate devices in Azure AD (one that is Azure AD registered from before and one that is Hybrid Azure AD joined) and both of them seems to be active (there's a column saying ACTIVITY and it's recent on both). The client itself also sees itself as still Azure AD registered in Settings > Accounts > Access work or school. We tried removing the Azure AD registered device in Azure AD but the client does not remove itself locally in Settings so it's left there. Not very beautiful but at least it works and we focus to deploy 1809 so it all solves by itself.
  • Ru's avatar
    Ru
    MVP
    Jul 12, 2019

    JonasBack  Just wanted to say thank you for this clarification as I am about to do this for my environment to prepare for an upgrade from O365 (with AD registered devices but not AAD Connect synced) to M365 (with hybrid join and AAD Connect synced).  The documentation from Microsoft here says 

    If your Windows 10 domain joined devices are already Azure AD registered to your tenant, we highly recommend removing that state before enabling Hybrid Azure AD join.

    without really explaining the result of not doing this.  If the only consequence of this is a doubling up, that's no problem; we'll just delete the redunant ones from AAD via the Azure Portal.

    • JonasBack's avatar
      JonasBack
      Iron Contributor
      Aug 15, 2019

      Ru We have seen strange behaviors when running a device both Azure AD registered + Hybrid Azure AD joined at the same time when it comes to Conditional Access. For example if we set a rule in Conditional Access NOT to force MFA for Hybrid Azure AD joined it will still sometimes ask for MFA if the device is both.

       

      So I still recommend making sure you don't end up there. Only way we found effective (without manual work on every client) - make sure to update them to 1809+ before starting.

      • symm_adrian's avatar
        symm_adrian
        Brass Contributor
        Sep 27, 2019

        I'm trying to work through this today. I've set a GPO to set the SCP as I'm attempting a controlled setup against one machine. However, when sync the OU with the computer and the GPO is applied, the machine doesn't appear to do anything and the state of the machine doesn't change from Azure AD Registered to Hybrid Azure AD Joined. Any ideas?

Resources