Forum Discussion

Iron Contributor

Nov 27, 2020

Solved

Domain joined & MDM managed

I find a lot of conflicting info on: Is it possible to manage (using MDM) a domain joined device without registering/joining it with Azure AD? Based on our tests, it seems possible. What is t...

mobile device management (mdm)

Thijs Lecomte
Dec 08, 2020
You will have automatic enrollment enabled which states that a device that is joined to AAD (or registered) will automatically enroll into Intune (https://docs.microsoft.com/en-us/mem/intune/enrollment/windows-enroll#enable-windows-10-automatic-enrollment).

You can block registration for domain joined PC's: HKLM\SOFTWARE\Policies\Microsoft\Windows\WorkplaceJoin: "BlockAADWorkplaceJoin"=dword:00000001.

Have you checked out this site for more information about registration? https://docs.microsoft.com/en-us/azure/active-directory/devices/concept-azure-ad-register

Azure AD Registration is something that is mostly done on personal devices.

For your corporate devices, hybrid join is the way to go. Because you can't force a device registration.

Hybrid Join also provides capabilities within conditional access, which registration does not.

bart_vermeersch

Iron Contributor

Dec 07, 2020

JanBakkerOrphaned that's a good question 🙂

I would like to understand the dependencies between "joined/registered/.." and "MDM/MAM".

If a user with a byod device is going through the AAD device registering flow (when configuring Outlook or Teams), what makes that the device will be enrolled in MDM? I understand the user can opt-in, during the registration flow, but how is this configured in Azure and when is it enrolled in MDM vs MAM?

A domain joined device (AD) can be enrolled in MDM without (hybrid)joining the device. What are the benefits of hybrid joining if the device can be managed in MDM and SSO is covered in ADFS?

In our tenant, on-prem domain joined devices are also listed as AAD registered, I always thought this was not possible and you had to use (hybrid)join.

Thanks!

Thijs Lecomte

Bronze Contributor

Dec 08, 2020

You will have automatic enrollment enabled which states that a device that is joined to AAD (or registered) will automatically enroll into Intune (https://docs.microsoft.com/en-us/mem/intune/enrollment/windows-enroll#enable-windows-10-automatic-enrollment).

You can block registration for domain joined PC's: HKLM\SOFTWARE\Policies\Microsoft\Windows\WorkplaceJoin: "BlockAADWorkplaceJoin"=dword:00000001.

Have you checked out this site for more information about registration? https://docs.microsoft.com/en-us/azure/active-directory/devices/concept-azure-ad-register

Azure AD Registration is something that is mostly done on personal devices.

For your corporate devices, hybrid join is the way to go. Because you can't force a device registration.

Hybrid Join also provides capabilities within conditional access, which registration does not.