Forum Discussion

IvoDuarte's avatar
IvoDuarte
Copper Contributor
Sep 10, 2024

Hybrid Join Process - Question

Hello all,   I'm looking for information regarding Hybrid Join process because it is not clear for me, this is what I have:   Entra Connect syncs what I have under the OU I have specified on its...
Azure AD Connect
Arne_Tiedemann's avatar
Arne_Tiedemann
Copper Contributor
Sep 11, 2024

IvoDuarte 

Good morning Ivo,

for Hybrid Join the device need to know the SCP "Service Connection Point", this configuration is normally done on installing Entra ID Connect but I does not use it in my deployments, because the SCP will be set in the Forest configuration and all devices will read it and will join to Entra ID when the device will be found in your tenant.
I use this way to deploy the SCP for Organizational units where I want to do Hybrid Join.
https://learn.microsoft.com/en-us/entra/identity/devices/hybrid-join-control#configure-client-side-registry-setting-for-scp

 

When does Hybrid join works:

  1. The Organizational unit where the devices are located must be selected for synchronization in Entra ID Connect. 
  2. The device read the SCP and connect to your tenant and write AD attribute "userCertificate"
  3. than the device will synchronized to Entra ID
  4. last Step, a user signin to the device with an user that have an Entra ID userPrincipalName

These are the steps for enabling Hybrid Join of devices.

In this https://learn.microsoft.com/en-us/entra/identity/devices/how-to-hybrid-join, you can read the requirements for Entra ID Hybrid join.

 

I hope this will help 🙂

 

 

  • IvoDuarte's avatar
    IvoDuarte
    Copper Contributor
    Sep 11, 2024

    Arne_Tiedemann ,

     

    Thanks for your time reading and replying my post 👍

     

    In my organization we have hybrid join working with SCP set in the Forest configuration.

    The targeted deployment of Microsoft Entra hybrid join looks a good approach too, thx for sharing!

     

    Here, everything is running and working fine. 🙂

     

    I still have some doubts because i did a test where seems to me that Entra Connect was not used for nothing. Let me explain my test:

     

    1. I've joined a device/computer into on-prem AD, out of the Organization Unit synchronized by Entra Connect.
    2. Entra Connect worked fine, it did not synchronized the device.... as expected! Also the device is not in the Metaverse, so far so good....
    3. A user signed-on in the computer.
    4. The Automatic-Device-Join task ran.
    5. The computer userCertificate attribute was populated.
    6. I can see the device in Entra ID portal.

    That's why I'm not understanding the role of Entra Connect in the process.

     

    Following Microsoft documentation (https://learn.microsoft.com/en-us/entra/identity/devices/device-registration-how-it-works#microsoft-entra-hybrid-joined-in-managed-environments)

     

    Step D -->  is not making me sense in my test...

     

    Step G --> The task sends a device registration request to Azure DRS that includes the ID token, certificate request, tkpub, and attestation data. Azure DRS validates the ID token, creates a device ID, and creates a certificate based on the included certificate request. Azure DRS then updates the device object in Microsoft Entra ID and sends the device ID and the device certificate to the client.

     

    I would say that Azure DRS updates the device object but it also creates a device object in case it does not exist in Microsoft Entra ID

     

    Anyway I was just trying to clarify this, i'm not facing any issues with the process on the daily basis, objects are synched and joined, so far so good... but I was just wondering what is the role of Entra Connect after all in this specific process...

     

    Once again thx for replying,

    All the best!!

    Ivo

     

     

     

     

     

    • Arne_Tiedemann's avatar
      Arne_Tiedemann
      Copper Contributor
      Sep 11, 2024

      Hi IvoDuarte,

       

      when you monitor the process step by step you can see in Entra ID connect that the device will be exported to the tenant after the userCertificate is set on the device.

      I the rules of Entra ID connect, there exists the last rule that says, if userCertificate of type device is not set, it will not fall into the synchronization. 

       

      Step by step

      1. Device get the scp
      2. connect to the tenant an authenticate to is an receive the userCertificate
      3. Entra ID connect sync the device at next run and the device is shown in the Entra ID Device portal with "pending"
      4. Entra ID user is signed in an the an do the last step and update the activity field with a time stamp
      5. finished

      One think to know: When the device is not synchronized, the process will not finished and the Event with ID 360 in Microsoft\Windows\User Device Registration will say => Device with device id not found in the tenant.

       

      And when you do not synchronize the devices with Entra ID connect, than it only work if a user register the device.

       

      Have a nice day

      Arne

      • IvoDuarte's avatar
        IvoDuarte
        Copper Contributor
        Sep 16, 2024

        Arne_Tiedemann 

         

        Good morning, sorry the late reply.

         

        Thanks for your clarifications, have a great week.

         

        Cheers!

        Ivo

Resources