Windows. Cloud. Management. Your questions answered.

We have hybrid devices coming in from AD connect and were initially imaged with SCCM. We show multiple entries but there is an entry that is an empty Join type. Then there is another entry that is Hybrid Join without a user account attached. What is the empty Join type entry?

That's correct that there are two Entra ID device objects at the end of Autopilot into Hybrid. The first object is the one for device registration into Autopilot in the first place. The intent is that that device object is joined to specific groups before the device is deployed, and then the policies assigned to the group are applied during deployment. The second object is created that reflects the device object in AD (primarily for authentication purposes). That second object should be joined to the same groups as the first object, and so the policies still apply. In general, if you change groups for the device AFTER deployment, the best practice is to move BOTH device objects, since that device could be reset at any time, at which time the first object takes effect (and this assumes you want the new group's policies to apply even after reset). Hope this helps, Dylan! -- Hung

The painful yet honest answer to this is "Don't Hybrid Autopilot". Aim for your new devices to be cloud native, you'll be thankful you did.