Azure AD Conditional Access - Require Domain Joined Device

[Joe Stocker]

Does the ‘Domain Join’ checkbox in Azure AD Conditional Access require Azure AD Domain join, or does it mean on-premises Domain Join? The attached screen shot says ‘Not Azure AD Domain Join’ but the documentation shown in the screen shot seems to contradict this.

[#2]

I don't understand how can I manage devices if some user in my organization have one company device as Hybrid Azure AD joined and another byod device as Azure AD registered.

Wich way I can use a condicional access rule to control access in both devices ?

[#3]

Conditional Access to require a domain joined device requires that the computer is joined to the on-premises Active Directory domain.

In other words, just registering a machine to Azure AD is not enough, the minimum requirement is that the computer must be joined to the on-premises domain.

I tested out each possible scenario in my lab and I posted the results on my blog site here:

http://www.thecloudtechnologist.com/azure-ad-premium-conditional-access-for-domain-joined-machines/

[#4]

Hi Joe,

All my devices are in my on-premise domain but lot's of them appear for me as "Azure AD registered"

And in this way I cant use a conditional access because the devices are not Compliant, what i'm doing wrong with the devices in my domain that they appear some of them as Azure AD registered and another devices appear as Hybrid Azure ad Join ?

[#5]

at the bottom of my long blog post, you'll find a troubleshooting section along with links to other helpful resources.

[#6]

with Pass-through Authentication what is work fllow for join machine in domain