Feb 10 2020
- last edited on
Jul 24 2020
We want to migrate our On-Prem AD devices to Azure AD and enroll into intune. We have Azure AD sync and all but needs to convert machine to Azure AD join only not Hybrid AD. So we would like to create new user profile on machine.
We have used two methods so far.
1) Reset the machine and use join to Azure AD from OOBE. ( Issue - This will make user a Administrator for that machine and we dont want that )
2) Unbind from on-prem AD, join to Azure AD manually but the same issue like number 1.
3) Using Hardware Hash, register devices to Autopilot and then reset all the machines. ( Issue - This will take too long to migrate 250 machines and helping remote workers are quite difficult )
Has anyone tried any different method or is there any expert suggestion ?
Feb 11 2020 03:22 AM
Feb 11 2020 01:19 PM
May 19 2020 12:13 PM - edited May 19 2020 12:14 PM
My company is attempting almost the exact same situation.... for 1800 devices.
Please, if anyone has a comprehensive strategy for this solution I'd appreciate it greatly.
My understanding developed from the linked articles is the steps for accomplishing this would be to:
1. create an AutoPilot profile which either acknowledges a present local administrator account or creates it when the device hits Azure
2. create a Group which applies the required applications for my company
3. use the Bulk update to target my on-premises machines for moving to Azure (how do I make sure the devices i select for bulk autopilot are not flagged as "personal" in on-premises AD?)
4. Clear my on-premises record of devices after each device appears in Azure AD
5. Start a sync in Intune and allow it to push apps and add any missing administrator account based on the Group and Profile settings
Thank you for any clarifications available.
Jun 11 2020 11:56 AM
Jun 11 2020 11:36 PM
Jul 11 2020 01:11 AM
Oct 09 2020 07:11 AM
@AvinashG Hey Avinash,
We have found out a work around to this.
While the machine is joined to a local domain domain1.com
To be able to enroll it in Intune MDM (without joining the doamin AzureCloud.com doamin).
You first have to remove any management tools for example (SCCM Client). Once that client is removed, you should be able to Enroll in Mobile Device management from Settings -> Accounts -> Access work or school. Under related settings, you will get an option to enroll in MDM, once you do it, it should be easy after that.
Hope this helps.
Oct 09 2020 07:33 AM
This isn't the full awnser to the question. The question was how to get from an Domain joined setup to a native Azure AD joined setup for existing devices. The steps you described involve enrolling an Domain device to Azure AD. It doesn't remove the device from the on-prem domain.
Oct 09 2020 07:45 AM
Oct 14 2020 03:12 AM
In my opinion, when you would need to script this, the difficulty would lie in the removal of the PC from the current AD to a workgroup:
* This could be done by using the remove-computer cmdlet. (with or without reboot, to be tested)
After that step, inject a WDC package to get it into AzureAD:
If you had your indentities synced up with AD Connect, the SID would be the same as would the profile,....(also to be tested)
Interested to hear other solutions also
Nov 03 2020 03:09 PM